turboAPI

<p align="center">
  <img src="assets/turbito.png" alt="TurboAPI" width="200" />
</p>

<p align="center">
  <a href="https://trendshift.io/repositories/23663" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/23663" alt="justrach%2FturboAPI | Trendshift" style="width: 250px; height: 55px;" width="250" height="55" /></a>
</p>

<p align="center">
  <a href="https://pypi.org/project/turboapi/"><img src="https://img.shields.io/pypi/v/turboapi.svg?style=flat-square&label=version" alt="PyPI version" /></a>
  <a href="https://github.com/justrach/turboAPI/blob/main/LICENSE"><img src="https://img.shields.io/github/license/justrach/turboAPI?style=flat-square" alt="License" /></a>
  <img src="https://img.shields.io/badge/python-3.14+-blue?style=flat-square" alt="Python 3.14+" />
  <img src="https://img.shields.io/badge/zig-0.17.0--dev.1862-f7a41d?style=flat-square" alt="Zig 0.17.0-dev.1862" />
  <img src="https://img.shields.io/badge/status-alpha-orange?style=flat-square" alt="Alpha" />
  <a href="https://deepwiki.com/justrach/turboAPI"><img src="https://deepwiki.com/badge.svg" alt="Ask DeepWiki" /></a>
</p>

<h1 align="center">TurboAPI</h1>

<h3 align="center">FastAPI-compatible Python framework. Zig HTTP core. Faster on HTTP-only and uncached HTTP+DB workloads.</h3>

<p align="center">
  Drop-in replacement · Zig-native validation · Zero-copy responses · Free-threading · dhi models
</p>

<p align="center">
  <a href="#-status">Status</a> ·
  <a href="#-quick-start">Quick Start</a> ·
  <a href="#-benchmarks">Benchmarks</a> ·
  <a href="#️-architecture">Architecture</a> ·
  <a href="#-migrating-from-fastapi">Migrate</a> ·
  <a href="#-why-python">Why Python?</a> ·
  <a href="#-observability">Observability</a> ·
  <a href="CONTRIBUTING.md">Contributing</a> ·
  <a href="SECURITY.md">Security</a>
</p>

---

## Status

> **Alpha software — read before using in production**
>
> TurboAPI works and has 380+ passing tests, but:
> - **No native TLS / HTTP/2 / HTTP/3 / QUIC** — put Caddy with Let's Encrypt,
>   nginx, `cloudflared`, Cloudflare, or another edge proxy in front for HTTPS
>   and modern protocols
> - **Basic slow-loris protection** exists via a 30s read timeout, but production
>   deployments should still use a reverse proxy with stricter limits
> - **No configurable max body size** — hardcoded 16MB cap
> - **Zig-native WebSocket support is available but still alpha** — routes are
>   exact-match. A synchronous route guard can reject Authorization or Origin
>   policy before the 101; the post-upgrade handler cannot. Accepted connections
>   transfer to a bounded dedicated pool with bounded duplex queues, so they do
>   not retain HTTP workers. Keep an authenticating edge such as Cloudflare
>   Access as the outer security boundary.
> - **Free-threaded Python 3.14t** is itself relatively new — some C extensions may not be thread-safe
>
> See [SECURITY.md](SECURITY.md) for the full threat model and deployment