Kirak

Model-driven CRUD engine and authentication runtime for FastAPI.

Define your database schema in JSON. Kirak generates the REST API, handles database migrations, enforces role-based access control, and provides a complete auth system – with zero boilerplate.

What you get

Feature	Details
CRUD API	`fetch`, `create`, `update`, `delete`, `destroy` routes auto-generated for every model
Authentication	JWT login/register, refresh tokens, email verification, password reset – always on
Social auth	Google, GitHub, Apple, Facebook, Instagram, TikTok OAuth (web + mobile)
OTP & MFA	SMS OTP login, TOTP multi-factor authentication
Role-based access	Per-operation access rules with per-row ownership conditions
Soft delete	`deleted_at`-based soft delete with hard destroy; auto-managed
Hooks	Before/after hooks on every CRUD operation and auth event
Migrations	CLI-driven schema migrations, dual-dialect (MySQL + PostgreSQL)
GraphQL	Auto-generated GraphQL endpoint from your models
MCP	MCP servers for AI agents, one JSON file each in `mcp/`: the operations each offers as tools, who may connect, a rate limit
Optional modules	Notifications, Payments, AI, Storage, Scheduler – lazy-loaded

Quick Start

pip install 'kirak[postgres]'   # or [mysql]
kirak new my-api --database postgres   # or mysql (the default)
cd my-api
pip install -e .                       # the project's dependencies, driver included
cp .env.example .env
# fill in database credentials and JWT secrets in .env
kirak db init
uvicorn main:app --reload

Your API is live at http://localhost:8000. GET /docs describes it in Markdown and GET /openapi.json as an OpenAPI document.

Documentation

Getting Started


Installation & Quick Start	Install, create a project, run your first API
First API Tutorial	End-to-end walkthrough: model, migration, API, hooks

Concepts – how Kirak works


Architecture	Request lifecycle and internal design
Defining Models	Field types, schema options, soft delete, relationships
Access Control	RBAC, row-level security, field-level access
Hooks & Events	Before/after hooks for CRUD and auth events
Response Envelope	The shared success/error response shape
Observability	Built-in RED metrics, request tracing, log capture, alerting

Guides – how to do specific tasks


CRUD Operations	Filters, pagination, ordering, bulk operations
GraphQL	The auto-generated GraphQL endpoint
Common Patterns	Cookbook of recurring access-control and data patterns
Testing	Testing Kirak-powered applications
Security Hardening	Production security checklist
Performance	Tuning and scaling guidance
Troubleshooting	Common errors and how to resolve them
AI Coding Agents	How coding agents get facts from the CLI and validate their edits

Authentication


Core Auth	JWT login/register, refresh tokens, email verification
Social Auth	Google, GitHub, Apple, Facebook, Instagram, TikTok OAuth
MFA & OTP	SMS OTP and TOTP multi-factor authentication
Standalone Auth	Running Kirak as a standalone auth service

Modules


Notifications	Email, SMS, push, chat and webhooks, plus an in-app inbox
Payments	Stripe, Razorpay, Square, PayPal, Paddle, Paystack, Flutterwave, Mercado Pago, Xendit, Airwallex, Omise, Telr
Storage	File and image upload: local disk, S3 and S3-compatible stores (Wasabi, R2, Spaces, Cubbit, OVHcloud, B2), Google Cloud Storage, Azure Blob
Scheduler	Background jobs, DB/Redis/RabbitMQ queues
AI Integration	Prompts and agents on OpenAI, Anthropic or Gemini (pydantic-ai)
Vector	Embeddings and vector search for RAG: Pinecone or S3 Vectors, OpenAI/Gemini/Ollama embeddings
MCP Servers	MCP servers for AI agents, declared in `mcp/*.json`

Reference


CLI	`kirak new`, facts and validation commands, `kirak db` migrations
Configuration	All environment variables and `kirak.json` options
Problem Codes	Stable codes of the problems `kirak validate` and the facts commands report
HTTP API Reference	Every route, request/response shape, and filter operator
Database Layer	Connection handling and dialect differences
Middleware	Request context and built-in middleware
Redis Integration	Rate limiting, token blacklist, OTP storage, scheduler queue
Rate Limiting	Per-model and global rate limit configuration
Monitoring	Monitoring endpoints and configuration keys

Examples

The examples/ directory contains self-contained runnable examples:

Example	What it covers
`01_hello_api/`	One model, migration, running API – start here
`02_blog/`	Multiple models, access control, full-text search, soft delete
`03_hooks/`	Lifecycle hooks for CRUD and auth events

Each example has its own models/, .env.example, kirak.json, and README. Run any example with:

cd examples/01_hello_api
cp .env.example .env   # fill in database credentials
kirak db init
uvicorn main:app --reload

Additional module-specific examples (notifications, payments, storage, scheduler, AI) are in examples/ alongside the numbered directories.

License

Apache License 2.0 – see LICENSE.md.