Skip to content

Flask MongoDB API

Production-ready RESTful reference API in Flask and MongoDB with bcrypt credential encryption, structured application logging, and containerized Docker setup.

PythonFlaskMongoDBDocker
Source

This is a focused backend project built to demonstrate clean API fundamentals.

Not every repository needs to be a multi-service distributed platform. Smaller reference services are valuable when they show how fundamental engineering habits are handled: predictable HTTP routing, proper database persistence, safe credential storage, structured logging, and containerized deployment.

I built this as a clean, ready-to-deploy user management REST API using Flask and MongoDB.

API contracts and system design

The service adheres to strict REST conventions with structured request and response contracts:

1. Resource endpoints and CRUD operations

  • POST /users: creates new user accounts with JSON schema validation, verifies email uniqueness, and returns 201 Created with sanitized user metadata (excluding password hashes).
  • GET /users: fetches the user collection with projection filtering to prevent leaking internal database fields.
  • GET /users/<user_id>: safely parses the hexadecimal MongoDB ObjectId, returning the user profile or an explicit 404 Not Found JSON error.
  • PUT /users/<user_id>: accepts partial field updates with validation before executing atomic update operations.
  • DELETE /users/<user_id>: deletes user records and returns confirmation.

2. Defensive security and password handling

Credential handling is treated with standard security discipline:

  • Passwords are encrypted using bcrypt with random salt generation, ensuring plaintext credentials never touch memory longer than necessary and are never stored in the database.
  • Environment configuration: sensitive credentials like MONGO_URI and SECRET_KEY are decoupled into .env files using python-dotenv, keeping secrets out of version control.

3. Centralized logging and operational hygiene

Troubleshooting production issues requires accessible telemetry:

  • Configured application logging that routes warning, info, and error events to logs/app.log with formatted timestamps and log levels.
  • Standardized JSON error response formatting for bad requests (400), unauthorized access (401), and missing resources (404).

4. Containerized local setup

To make the service immediately reproducible across different developer environments:

  • Packaged with a lightweight Dockerfile configuring Python runtime dependencies and explicit port exposure (5000).
  • Easily paired with local MongoDB instances or cloud clusters like MongoDB Atlas.

Why it stayed

Simple projects make software habits obvious.

Code structure, route naming, error handling, secrets hygiene, and logging discipline are easier to evaluate in a compact service than in a large monolith. When building larger platforms, these same core habits make the difference between reliable systems and brittle ones.