Deploy FastAPI on a VPS with Uvicorn and Nginx

An API that answers on localhost is not yet available to your users. FastAPI uses ASGI and needs a compatible server such as Uvicorn, a process manager to keep it running and a public HTTPS route. A VPS lets you install and control those parts; day-to-day operation—updates, keys, firewall, data and recovery—remains your responsibility.

This guide uses Debian or Ubuntu, Uvicorn, systemd and Nginx. app.main and the app object are examples; adapt the import to your repository. If your project also has a frontend, database, queue or scheduled jobs, plan and test each service separately.

1. Find the ASGI object to run

Look for requirements.txt or pyproject.toml, the required Python version and where the project creates FastAPI(). It might expose the application as main:app, app.main:app or another import path. If it uses a factory that returns the application, Uvicorn also supports --factory; verify the function name and signature before using it.

Run the API locally and test real routes, authentication, uploads, error responses and external dependencies. Review AI-generated code for credentials in Git, keys that could end up in browser JavaScript, overly broad CORS and settings that only work on localhost. Decide whether /docs, /redoc and /openapi.json should be public for your use case.

2. Prepare Python on a VPS

Choose a Hostbrid VPS with Debian or Ubuntu compatible with your Python version. Connect over SSH, apply updates and open only the ports you need. Create a non-admin service account and a virtual environment:

sudo apt update
sudo apt install git python3-venv nginx
sudo adduser --system --group --home /srv/fastapi fastapi
sudo -u fastapi python3 -m venv /srv/fastapi/venv

Clone the project into /srv/fastapi/current and protect any private-repository credential. Install the dependencies declared by the app inside its virtual environment:

sudo -u fastapi /srv/fastapi/venv/bin/pip install -r /srv/fastapi/current/requirements.txt

Check whether Uvicorn is listed as a production dependency; some projects already include it, while others need to add it. Do not install the application into the operating system’s global Python.

3. Keep secrets and configuration separate

Store production variables outside Git in a restricted file such as /etc/fastapi.env. Your application must read them explicitly. Use new production values for database credentials, authentication, email services and external APIs. Never publish a .env, private key or token in the frontend, repository or logs.

If a browser calls the API from another domain, configure CORS for the exact origins that web app needs. Do not use a wildcard without understanding its effect: when credentials are involved, FastAPI requires explicit origins, methods and headers. CORS is a browser policy; it does not replace authentication or constrain server-to-server API clients.

If the API stores persistent data, identify its location and write permissions. Back it up before a schema migration and document how to restore it. Keep user uploads separate from code and decide which metrics, logs and personal data you actually need to retain.

4. Keep Uvicorn running

Test the actual import path first. This example loads app from app/main.py and listens on loopback so public traffic must go through Nginx:

cd /srv/fastapi/current
sudo -u fastapi /srv/fastapi/venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 8000

For a compatible factory, adapt the path and add --factory. Start with one process and measure usage. More workers can use additional CPU cores, but each process generally needs its own memory; do not copy a universal worker count without measuring your API and VPS size.

After the test works, create /etc/systemd/system/fastapi.service to start Uvicorn at boot and recover it after a failure:

[Unit]
Description=FastAPI application
After=network.target

[Service]
User=fastapi
Group=fastapi
WorkingDirectory=/srv/fastapi/current
EnvironmentFile=/etc/fastapi.env
ExecStart=/srv/fastapi/venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 8000 --proxy-headers --forwarded-allow-ips=127.0.0.1
Restart=on-failure

[Install]
WantedBy=multi-user.target

Adapt the import, check environment-file permissions, then run sudo systemctl daemon-reload and sudo systemctl enable --now fastapi. Inspect sudo systemctl status fastapi, journalctl -u fastapi and a local request to http://127.0.0.1:8000/. Uvicorn should trust forwarded headers only from the proxy you control.

5. Put Nginx and HTTPS in front

Configure Nginx to receive requests and forward them to the local process. Change the domain and keep the / path that your API expects:

server {
    listen 80;
    server_name api.example.com;

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Enable the site and validate it with sudo nginx -t before reloading. Point DNS to the VPS, allow the required web traffic and configure a TLS certificate. Redirect HTTP to HTTPS. If you use WebSockets or large uploads, set and test those limits explicitly.

FastAPI generates OpenAPI documentation and can serve it at /docs and /redoc. Review the specification and access policy; you can disable those routes in the app configuration if they should not be public. Hiding documentation does not secure an API: each endpoint still needs access controls.

6. Test the API and recovery path

From another machine, test the domain, HTTPS, authentication, CORS from the frontend, error routes, upload limits and dependencies. Restart systemd and confirm the API returns. Review logs without dumping secrets or sensitive request bodies. Automate database and file backups, then test a restore. If you run migrations or startup tasks, control their order so multiple instances do not repeat them at once.

This deployment is self-managed: Hostbrid supplies a VPS with root access, while you install and maintain Python, FastAPI, Uvicorn, Nginx, HTTPS, updates, firewall and backups. Compare VPS sizes and current prices with measured API, worker and service usage.

Official references: FastAPI on deployment, concepts, workers, CORS, Uvicorn behind a proxy and Nginx reverse proxy.