The office is quiet. The Slack notifications have stopped. You have a few days off and that side project idea has been burning a hole in your brain for months. Let's build it. And let's not waste a single holiday minute on authentication boilerplate. ## The Stack For this holiday build, we're going with: - **FastAPI** (Python) - Fast, modern backend - **SvelteKit** - Elegant, reactive frontend - **Turalogin** - Email auth in 15 minutes - **SQLite** - Zero-config database (upgrade later if needed) This stack optimizes for "fun to build" and "ships fast." ## Project Setup (10 minutes) ### Backend (FastAPI) ```bash mkdir holiday-project && cd holiday-project mkdir backend && cd backend python -m venv venv source venv/bin/activate # or `venv\Scripts\activate` on Windows pip install fastapi uvicorn httpx python-multipart ``` Create `backend/main.py`: ```python from fastapi import FastAPI, HTTPException, Response, Request from fastapi.middleware.cors import CORSMiddleware import httpx import os from datetime import datetime, timedelta import secrets app = FastAPI() # CORS for SvelteKit dev server app.add_middleware( CORSMiddleware, allow_origins=["http://localhost:5173"], allow_credentials=True, allow_methods=["*"], allow_headers=["*"], ) # Simple session store (use Redis in production) sessions = {} TURALOGIN_API_KEY = os.getenv("TURALOGIN_API_KEY") FRONTEND_URL = os.getenv("FRONTEND_URL", "http://localhost:5173") ``` ### Frontend (SvelteKit) ```bash cd .. npm create svelte@latest frontend # Select: Skeleton project, TypeScript, ESLint, Prettier cd frontend npm install ``` ## Authentication (15 minutes) ### Backend Auth Routes Add to `backend/main.py`: ```python @app.post("/api/auth/login") async def login(email: str): async with httpx.AsyncClient() as client: response = await client.post( "https://api.turalogin.com/v1/auth/start", json={ "email": email, "redirect_url": f"{FRONTEND_URL}/auth/verify", }, headers={ "Content-Type": "application/json", "X-API-Key": TURALOGIN_API_KEY, }, ) if response.status_code != 200: raise HTTPException(status_code=500, detail="Failed to send login email") return {"sent": True} @app.post("/api/auth/verify") async def verify(token: str, response: Response): async with httpx.AsyncClient() as client: turalogin_response = await client.post( "https://api.turalogin.com/v1/auth/verify", json={"token": token}, headers={ "Content-Type": "application/json", "X-API-Key": TURALOGIN_API_KEY, }, ) if turalogin_response.status_code != 200: raise HTTPException(status_code=401, detail="Invalid or expired token") data = turalogin_response.json() email = data["email"] # Create session session_id = secrets.token_urlsafe(32) sessions[session_id] = { "email": email, "expires": datetime.now() + timedelta(days=7), } response.set_cookie( key="session", value=session_id, httponly=True, max_age=7 * 24 * 60 * 60, samesite="lax", ) return {"email": email} @app.get("/api/auth/me") async def get_current_user(request: Request): session_id = request.cookies.get("session") if not session_id or session_id not in sessions: raise HTTPException(status_code=401, detail="Not authenticated") session = sessions[session_id] if datetime.now() > session["expires"]: del sessions[session_id] raise HTTPException(status_code=401, detail="Session expired") return {"email": session["email"]} @app.post("/api/auth/logout") async def logout(request: Request, response: Response): session_id = request.cookies.get("session") if session_id and session_id in sessions: del sessions[session_id] response.delete_cookie(key="session") return {"logged_out": True} ``` ### Frontend Auth Components Create `frontend/src/lib/auth.ts`: ```typescript const API_URL = 'http://localhost:8000'; export async function sendLoginEmail(email: string): Promise { const response = await fetch(`${API_URL}/api/auth/login`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ email }), credentials: 'include', }); return response.ok; } export async function verifyToken(token: string): Promise { const response = await fetch(`${API_URL}/api/auth/verify`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ token }), credentials: 'include', }); if (response.ok) { const data = await response.json(); return data.email; } return null; } export async function getCurrentUser(): Promise { try { const response = await fetch(`${API_URL}/api/auth/me`, { credentials: 'include', }); if (response.ok) { const data = await response.json(); return data.email; } } catch {} return null; } export async function logout(): Promise { await fetch(`${API_URL}/api/auth/logout`, { method: 'POST', credentials: 'include', }); } ``` Create `frontend/src/routes/login/+page.svelte`: ```svelte {#if sent}

Check your email!

Click the link to log in.

{:else} {/if} ``` Create `frontend/src/routes/auth/verify/+page.svelte`: ```svelte {#if error}

Login Failed

The link is invalid or expired.

Try again

{:else}

Verifying.

{/if} ``` ## Running It Terminal 1 (backend): ```bash cd backend source venv/bin/activate TURALOGIN_API_KEY=your_key uvicorn main:app --reload ``` Terminal 2 (frontend): ```bash cd frontend npm run dev ``` Visit `http://localhost:5173/login`, enter your email, click the link, you're in. **Total auth time: ~15 minutes.** ## Building Your Actual Project Now the fun part. You have the rest of your holiday to build: - The feature that's been stuck in your head - The UI you've been sketching on napkins - The API endpoints that do the cool thing Some holiday project ideas: - **Personal finance tracker** - Categorize spending, set goals - **Recipe manager** - Save recipes, plan meals, generate shopping lists - **Reading log** - Track books, notes, recommendations - **Habit tracker** - Daily streaks, visualizations - **Link saver** - Personal bookmarking with tags and search Each of these benefits from user accounts. Each would be slower to build if you spent 2 hours on auth. ## The Holiday Project Mindset Side projects during holidays should be: 1. **Fun** - If it's not enjoyable, it won't get finished 2. **Self-contained** - Minimal dependencies, simple deployment 3. **Achievable** - Scope for the time you have 4. **Learning-oriented** - Try something new Authentication shouldn't factor into any of these. It's plumbing. Make it work fast and move on. ## Deployment When Ready When you want to share your holiday project: **Backend (Railway/Render/Fly.io):** ```bash # Add requirements.txt pip freeze > requirements.txt # Push to GitHub, connect to hosting platform ``` **Frontend (Vercel/Netlify):** ```bash # Push to GitHub, connect to hosting platform # Update API_URL environment variable ``` **Turalogin:** - Update redirect_url to production domain - Same API key, same code ## Enjoy Your Holiday You've got simple auth. You've got a modern stack. You've got time off. Build something fun. Ship something real. And don't spend your vacation debugging OAuth. Happy holidays. Happy building. --- *Got a holiday project in mind? [Get your API key](/login) and start building today.*

Check your email!

Log In

Login Failed