Flask.

Create an instance of the Flask class, then map URLs to view functions with the @app.route() decorator.

from flask import Flask

app = Flask(__name__)

@app.route('/')
def hello_world():
    return 'Hello, World!'

if __name__ == '__main__':
    app.run(debug=True)

Flask(__name__) creates the application instance, the object a web server calls for each request. The @app.route('/') decorator binds / to hello_world, and the returned string becomes the response body.

app.run(debug=True) starts the development server when you run the file directly. From the terminal, flask --app hello run --debug does the same, where hello is the module name. Use the development server and its debugger only on your own machine, never in production.

__name__ gives Flask the import name of the module or package that holds the app. Flask uses it to find the app's root path, so it knows where to look for the templates and static folders.

The import name also helps tools around the app. Extensions can use it for debugging information. Flask-SQLAlchemy, for example, uses it to show which code in your app ran a query.

The value depends on how the file runs. When you run it directly, __name__ is '__main__'. When it is imported, __name__ holds the real module name, such as myapp.

Pass a methods list to the route decorator, then branch on request.method inside the view. Without that list, a route answers only GET.

@app.route('/api/users', methods=['GET', 'POST'])
def handle_users():
    if request.method == 'POST':
        return create_user()
    return get_users()

@app.route('/api/users/<int:user_id>', methods=['PUT', 'DELETE'])
def handle_user(user_id):
    if request.method == 'PUT':
        return update_user(user_id)
    elif request.method == 'DELETE':
        return delete_user(user_id)

Flask adds HEAD for you whenever GET is allowed, and it answers OPTIONS requests on its own. A request with any other method gets 405 Method Not Allowed, and the view never runs.

One view for several methods suits code that shares setup. Separate views are often easier to read, and Flask has shortcut decorators such as @app.get() and @app.post() for them. For a whole resource, MethodView maps each HTTP method to a class method with the same name, such as get or delete.

URL variables are parts of a route marked with angle brackets, such as <username>. Flask captures that part of the URL and passes it to the view as a keyword argument.

@app.route('/user/<username>')
def show_user(username):
    return f'User: {username}'

@app.route('/post/<int:post_id>')
def show_post(post_id):
    return f'Post ID: {post_id}'

@app.route('/path/<path:subpath>')
def show_subpath(subpath):
    return f'Subpath: {subpath}'

A converter sets the type, as in <int:post_id>:

• string is the default and accepts any text without a slash.
• int accepts positive integers.
• float accepts positive floating point values.
• path is like string but also accepts slashes.
• uuid accepts UUID strings.

A value that does not fit its converter matches no route, so /post/abc returns 404 Not Found and never reaches show_post.

URL building means generating a URL from an endpoint name instead of typing the path by hand. url_for() takes the endpoint, usually the view function's name, plus a keyword argument for each URL variable.

from flask import url_for

@app.route('/user/<username>')
def user_profile(username):
    return f'Profile for {username}'

@app.route('/')
def index():
    # Generate URL for user_profile endpoint
    profile_url = url_for('user_profile', username='john')
    return f'<a href="{profile_url}">John\'s Profile</a>'

Here url_for('user_profile', username='john') returns /user/john. Arguments that match no URL variable become query parameters. This reverse lookup has three benefits:

• Changing a route updates every link that uses its endpoint.
• Special characters are escaped for you.
• The paths are absolute, and they stay correct when the app is mounted under a prefix.

Read them from request.args, which holds the parsed query string as a MultiDict. A MultiDict can keep several values for one key.

from flask import request

@app.route('/search')
def search():
    query = request.args.get('q', '')
    page = request.args.get('page', 1, type=int)
    category = request.args.getlist('category')  # Multiple values
    
    return f'Query: {query}, Page: {page}, Categories: {category}'

• get('q', '') returns the default when the key is missing.
• get('page', 1, type=int) converts the value and falls back to the default when the conversion fails, so ?page=abc gives 1.
• getlist('category') returns every value, so ?category=a&category=b gives both, and a missing key gives an empty list.

Indexing with request.args['q'] raises a KeyError for a missing key, and Flask turns that into 400 Bad Request. Prefer get(), because users can edit a URL by hand. Values arrive as strings until you convert them.

Import the request object and read the attribute for the part of the request you need. request looks like a global, but it is a context-local proxy, so each worker sees only the request it is handling.

from flask import request

@app.route('/form', methods=['POST'])
def handle_form():
    # Form data
    username = request.form['username']
    email = request.form.get('email', '')
    
    # Files
    if 'file' in request.files:
        file = request.files['file']
    
    # Headers
    auth_header = request.headers.get('Authorization')
    
    # Cookies
    session_id = request.cookies.get('session_id')
    
    return 'Data processed'

• request.form holds fields from a form body. form['username'] raises a KeyError when the field is missing, and Flask turns that into 400 Bad Request. form.get() returns a default instead.
• request.files holds uploads. It stays empty unless the form was sent as multipart/form-data.
• request.headers and request.cookies work like dictionaries, so get() is the safe way to read them.

Other parts sit beside these. request.args holds the query string, request.get_json() parses a JSON body, and request.method gives the HTTP method.

They read three different parts of a request. request.args is the URL query string, request.form is a form-encoded body, and request.get_json() parses a JSON body.

# URL: /api?page=1
# Body: {"name": "John"}

@app.route('/api', methods=['POST'])
def api():
    page = request.args.get('page')        # "1"
    name = request.get_json()['name']      # "John"
    username = request.form.get('username') # None, because the body is JSON

A request has only one body, so form and get_json() never both get data from the same request. That is why username is None above. When either source is fine, request.values combines args and form. Use args for filters and paging, form for HTML form posts, and get_json() for API clients.

Flask is a lightweight Python web framework for building web apps and APIs. Its core handles routing, requests and templates, and leaves the other choices to you.

It is called a microframework because its core stays small but extensible. Apps built with it do not have to be small. Flask has no database layer, form library or user system. You add those through extensions such as Flask-SQLAlchemy and Flask-Login, or with any library you prefer.

Flask is built on two libraries:

• Werkzeug handles the low-level request and response work, the routing and the development server.
• Jinja renders the templates.

The trade-off is that you choose and wire up the database layer, forms and user system yourself.