Complete Flask Tutorial: From Basics to API Development

Flask is a lightweight web framework written in Python. It’s often called a “micro-framework” because it doesn’t force you into a fixed structure or come with a lot of built-in tools. You start with the basics and add only what you need.   

Here’s why developers like it:

• Simple to start: You can build a working web app in just five lines of code.
• Flexible: You choose your own database, tools, and project structure.
• Great for APIs: Perfect for building REST APIs and microservices.
• Large community: Plenty of extensions, tutorials, and answers on forums.
• Beginner-friendly: If you know basic Python, you can pick it up quickly.   

Companies use Flask for everything from small internal tools to machine learning model deployment. That makes this Flask tutorial a skill worth investing in. 

Before writing code, let’s set up a clean workspace.

Step 1: Install Python

Make sure Python 3.8 or higher is installed. Check with:

Step 2: Create a Virtual Environment

A virtual environment keeps your project’s packages separate from other projects. It’s a habit worth building early.

Activate it:

• Windows: venv\Scripts\activate
• Mac/Linux: source venv/bin/activate

Step 3: Install Flask

That’s it. You’re ready to build.

Create a file named app.py and add this:

Run it:

Open http://127.0.0.1:5000 in your browser, and you’ll see your message.

What just happened?

• Flask(__name__) creates the application.
• @app.route(“/”) is a decorator that links a URL to a function.
• debug=True turns on debug mode, which reloads the server automatically when you change code and shows helpful error messages.  

Never use debug mode in production, as it can expose sensitive information.

Routes decide what happens when someone visits a particular URL. Flask makes this easy.

Visit /user/Riya and you’ll see “Hello, Riya!”. The <name> part is a variable that Flask passes to your function.

You can also specify types:

Supported converters include string, int, float, and path.

Handling HTTP Methods

By default, routes only accept GET requests. To accept others, specify them:

This will be especially useful when we get to the API section.

Returning plain text is fine for testing, but real websites need HTML. Flask uses Jinja2, a template engine, to build dynamic pages.

Create a folder called templates and add a file index.html:

Now render it from your route:

Key things to know about Jinja2:

• {{ }} prints a variable.
• {% %} runs logic like loops and conditions.
• Templates can inherit from a base layout using {% extends “base.html” %}, which saves you from repeating headers and footers.

Static files like CSS, JavaScript, and images go in a folder called static. You can link to them with url_for(‘static’, filename=’style.css’).

Let’s build a simple form that takes a user’s name.

form.html

app.py

The request object holds everything about the incoming request: form data, query parameters, headers, and JSON.

• request.form → form data
• request.args → query string (e.g., ?page=2)
• request.json → JSON body

For larger apps, look into Flask-WTF, which adds form validation and CSRF protection.

Almost every real application needs to store data. The most popular choice is Flask-SQLAlchemy, an ORM that lets you work with databases using Python classes instead of raw SQL.

Install it:

Set it up:

Here’s what’s happening:

• We’re using SQLite, which needs no installation and is perfect for learning.
• Task is a model, which maps to a table in the database.
• db.create_all() creates the tables if they don’t exist.
• The to_dict() method converts a task into a dictionary, which makes it easy to return as JSON later.

Later, you can switch to PostgreSQL or MySQL by changing just the connection string.

Now for the part many of you are waiting for. This Flask API tutorial section will walk you through building a simple Task Manager API with full CRUD operations: Create, Read, Update, and Delete.

What Is a REST API?

A REST API lets different applications talk to each other over HTTP. It uses standard methods:

Step 1: Get All Tasks

jsonify converts Python data into a proper JSON response with the right headers.

Step 2: Get a Single Task

get_or_404 automatically returns a 404 error if the task doesn’t exist.

Step 3: Create a Task

Notice the status code 201, which means “Created”. Using correct status codes is a mark of a well-designed API.

Step 4: Update a Task

Step 5: Delete a Task

Congratulations, you now have a working REST API.

Testing Your API

You can test using Postman, Insomnia, or simply curl:

Then fetch all tasks:

Good APIs return clear, consistent errors instead of ugly HTML pages. Flask lets you register custom error handlers.

Now every 404 or 500 error returns clean JSON that frontend developers can easily handle.

As your app grows, putting everything in one file becomes messy. Flask offers Blueprints to split your app into logical pieces.

Register it in your main file:

A clean project structure often looks like this:

Most real APIs need to protect certain endpoints. A popular approach is JWT (JSON Web Tokens) using the flask-jwt-extended package.

The client logs in, receives a token, and sends it in the Authorization: Bearer <token> header with later requests. In a real application, always hash passwords (use werkzeug.security) and store secrets in environment variables, never in your code.

Once you’re comfortable with the basics, these habits will make your code cleaner and safer:

1. Use environment variables for secrets and configuration (try python-dotenv).
2. Validate input with libraries like Marshmallow or Pydantic.
3. Use proper status codes: 200, 201, 400, 401, 404, and 500 cover most cases.
4. Version your API (for example, /api/v1/tasks) so you can make changes without breaking existing users. 
5. Enable CORS with flask-cors if your frontend runs on a different domain.  
6. Write tests using pytest and Flask’s built-in test client. 
7. Document your API using Swagger or Flask-RESTX.
8. Never run debug mode in production. 

Flask’s built-in server is only for development. For production, use a proper WSGI server such as Gunicorn:

Popular deployment options include:

• Render and Railway: beginner-friendly deployment platforms
• Heroku: a platform for deploying web applications
• AWS, Google Cloud, Azure: for larger, scalable projects
• Docker: package your app into a container that runs consistently across environments

Pair Gunicorn with Nginx as a reverse proxy for better performance and security on your own servers.

Learning from other people’s slip-ups saves time: 

• Skipping virtual environments, which leads to package conflicts.
• Forgetting app.app_context() when working with the database outside a request.
• Hardcoding secrets like passwords and API keys. 
• Not handling errors, which leaves users with confusing responses.
• Putting everything in one file until it becomes impossible to manage.   
• Forgetting to commit the database session after changes.

Flask proves that web development doesn’t have to be complicated. In this Flask tutorial, you’ve covered routes, templates, forms, databases, a full REST API, authentication, error handling, and deployment basics.  

The best next step is to build something of your own, such as a to-do app, a notes API, a blog backend, or a simple expense tracker. Every bug you fix and every feature you add will teach you more than any article can. 

Keep this flask api tutorial handy as a reference, experiment with the code, and don’t be afraid to break things. That’s how great developers are made.  

Happy coding!