Installation

fastapi-rls has an ORM-agnostic core with optional adapters, so you only pull in what you use. import fastapi_rls works even when SQLAlchemy, FastAPI, and Alembic are not installed.

Extras

pip install "fastapi-rls[all]"          # everything
pip install "fastapi-rls[fastapi]"      # FastAPI + SQLAlchemy (most apps)
pip install "fastapi-rls[sqlalchemy]"   # SQLAlchemy only
pip install "fastapi-rls[alembic,cli]"  # migrations + the standalone CLI

Extra	Pulls in	Use it for
sqlalchemy	SQLAlchemy 2.0	The RLSMixin, executors, and the RLS facade
fastapi	FastAPI + SQLAlchemy	The request session dependencies and middleware
alembic	Alembic	op.enable_rls / op.create_policy migration directives
cli	Typer	The fastapi-rls command-line tool
psycopg	psycopg 3	A sync PostgreSQL driver
asyncpg	asyncpg	An async PostgreSQL driver
all	all of the above	Getting started quickly

You still choose your own driver. A common sync setup:

pip install "fastapi-rls[fastapi]" "psycopg[binary]"

And async:

pip install "fastapi-rls[fastapi]" asyncpg

Requirements

• Python 3.10–3.13
• PostgreSQL 13–17
• SQLAlchemy 2.0
• FastAPI ≥0.100

Every one of these versions is exercised in the CI test matrix (each Python against Postgres 17, each Postgres against Python 3.12, plus a job pinned to the oldest dependency versions we advertise).

A non-superuser database role is mandatory

PostgreSQL superusers and BYPASSRLS roles ignore RLS entirely. Your application must connect as an ordinary role, or every policy silently becomes a no-op. This is the single most common way to "install RLS" and still leak data. See the security model.

Verify

python -c "import fastapi_rls; print(fastapi_rls.__version__)"
fastapi-rls --help   # if you installed the [cli] extra

Next: the quick start.