Best Python Libraries for Building REST APIs Without a Full Framework in 2026

If you've spent any time building Python web services, you know the feeling: you open a new project, reach for Django or Flask, and then stop yourself. Do I really need all of this? Sometimes you don't. Sometimes you want to own your stack, pick your own pieces, and avoid dragging in hundreds of lines of framework boilerplate for an API that serves twenty endpoints.

The good news is that the Python ecosystem in 2026 is absolutely stacked with purpose-built libraries that handle specific parts of the REST API puzzle — routing, serialization, validation, authentication, documentation — without forcing you into a monolithic framework. You compose the stack yourself, and the result is leaner, faster, and easier to reason about.

This post breaks down the best libraries in each category, when to use them, and how they fit together.

Why Go Frameworkless?

Before diving in, let's be clear about the trade-off. Full frameworks like FastAPI, Django REST Framework, or Flask-RESTful are excellent and genuinely worth using for most projects. But there are real scenarios where rolling your own stack pays off:

• Microservices with narrow responsibilities — a single service that does one thing doesn't need an ORM, a templating engine, or admin scaffolding.
• Performance-critical APIs — fewer layers mean fewer allocations and faster response times.
• Learning and ownership — understanding what each layer does makes you a better engineer.
• Custom requirements — sometimes framework opinions conflict with your architecture decisions.

With that context, here's what you actually need to build a production REST API:

1. An ASGI/WSGI server
2. A router
3. Request/response handling
4. Validation and serialization
5. Authentication middleware
6. Documentation generation
7. Testing utilities

Let's tackle each one.

ASGI Servers: The Foundation

Uvicorn

Uvicorn is the de-facto ASGI server for Python in 2026. Built on uvloop and httptools, it's blazing fast and handles HTTP/1.1, HTTP/2, and WebSockets. It's what FastAPI and Starlette run on under the hood.

pip install uvicorn[standard]

You can run any ASGI application with it:

# main.py
async def app(scope, receive, send):
    assert scope['type'] == 'http'
    await send({'type': 'http.response.start', 'status': 200, 'headers': []})
    await send({'type': 'http.response.body', 'body': b'Hello, world'})

uvicorn main:app --reload

For production, pair it with Gunicorn using the Uvicorn worker class for process management.

Granian

If you're chasing raw performance in 2026, Granian is worth a look. It's a Rust-based HTTP server with native ASGI support that consistently benchmarks faster than Uvicorn in high-throughput scenarios. Drop-in replacement in most cases.

Routing: Starlette's Router as a Standalone Component

Starlette Router

Here's something most people don't realize: you can use Starlette's Router class completely independently without adopting the full Starlette application. It gives you clean URL routing, path parameters, and middleware support.

from starlette.routing import Router, Route
from starlette.requests import Request
from starlette.responses import JSONResponse

async def get_users(request: Request):
    return JSONResponse({"users": []})

async def get_user(request: Request):
    user_id = request.path_params["user_id"]
    return JSONResponse({"id": user_id})

routes = [
    Route("/users", get_users),
    Route("/users/{user_id:int}", get_user),
]

app = Router(routes=routes)

This gives you exactly what you need without pulling in Starlette's middleware stack, background tasks, or static file handling unless you want them.

RSGI Router (Alternative: lilya)

Lilya is an evolution of Esmerald's internals that works as a standalone ASGI router. It's more opinionated than raw Starlette routing but still much lighter than a full framework. Worth checking out if you want slightly more structure around path operations.

Validation and Serialization

This is where most of the heavy lifting happens in any API, and this is the category where Python has the richest selection.

Pydantic v2

Pydantic is the gold standard for data validation in Python. Version 2 rewrote the core in Rust, making it dramatically faster than v1. Even without FastAPI wrapping it, you can use Pydantic directly to validate incoming request bodies and serialize outgoing responses.

from pydantic import BaseModel, EmailStr, field_validator

class CreateUserRequest(BaseModel):
    name: str
    email: EmailStr
    age: int

    @field_validator('age')
    @classmethod
    def age_must_be_positive(cls, v):
        if v < 0:
            raise ValueError('Age must be non-negative')
        return v

# In your route handler
async def create_user(request: Request):
    body = await request.json()
    try:
        user_data = CreateUserRequest(**body)
    except ValidationError as e:
        return JSONResponse(e.errors(), status_code=422)
    # ... persist user_data

Pydantic's model_dump() for serialization and .model_validate() for validation cover 95% of your needs cleanly.

Marshmallow

Marshmallow is the older sibling — it predates Pydantic and takes a different philosophy. Schema definitions are separate from your data models, which some teams prefer for explicit separation of concerns. It's also more flexible for complex nested serialization scenarios.

pip install marshmallow

Marshmallow is a particularly good choice if you're working with SQLAlchemy models and don't want to duplicate your schema definitions as Pydantic models.

Msgspec

For pure performance obsessives, msgspec is extraordinary. It's a Rust-backed library that handles both validation and serialization, and it's measurably faster than Pydantic v2 in many benchmarks. The API is slightly less ergonomic, but for high-throughput APIs the performance gains are real.

HTTP Client-Side: Handling Requests Properly

httpx

When your API needs to call other services (and they all do eventually), httpx is the right tool. It's fully async, supports HTTP/2, and has a nearly identical interface to requests so the learning curve is minimal.

pip install httpx

It also has a test client that lets you make requests against your ASGI app without spinning up a real server — which becomes important in the testing section.

Authentication and Authorization

PyJWT

PyJWT handles JWT encoding and decoding without opinionated middleware built around a specific framework. You write your own middleware, but that's exactly the point — you control the flow.

import jwt
from starlette.middleware.base import BaseHTTPMiddleware

SECRET_KEY = "your-secret"
ALGORITHM = "HS256"

class JWTMiddleware(BaseHTTPMiddleware):
    async def dispatch(self, request, call_next):
        token = request.headers.get("Authorization", "").replace("Bearer ", "")
        try:
            payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
            request.state.user = payload
        except jwt.ExpiredSignatureError:
            return JSONResponse({"error": "Token expired"}, status_code=401)
        except jwt.InvalidTokenError:
            return JSONResponse({"error": "Invalid token"}, status_code=401)
        return await call_next(request)

Authlib

For OAuth 2.0 flows, Authlib is the most complete Python implementation. It handles token issuance, refresh flows, and integrates with popular identity providers. Unlike framework-specific OAuth libraries, Authlib works with any ASGI stack.

Rate Limiting and Caching

slowapi

slowapi is inspired by Flask-Limiter and works independently with any ASGI application. It uses Redis or in-memory backends for tracking request counts.

aiocache

aiocache gives you async caching with Redis, Memcached, or in-memory backends. Caching serialized responses is often the single highest-impact optimization you can make to an API.

Database Access Without an ORM

If you're frameworkless, you probably don't want a heavy ORM either. Two libraries stand out:

SQLAlchemy Core (not ORM)

SQLAlchemy is famous for its ORM, but the Core layer gives you a powerful SQL expression language and connection pooling without any ORM magic. Pair it with the async extension and you have a solid database layer.

from sqlalchemy.ext.asyncio import create_async_engine, AsyncSession
from sqlalchemy import text

engine = create_async_engine("postgresql+asyncpg://user:pass@localhost/db")

async def get_users():
    async with AsyncSession(engine) as session:
        result = await session.execute(text("SELECT * FROM users"))
        return result.fetchall()

Databases

The databases library from the Encode team (same people who built Starlette) provides a simple async interface to PostgreSQL, MySQL, and SQLite without the SQLAlchemy overhead. It's the lightest path to async database queries.

API Documentation

One thing you lose going frameworkless is automatic OpenAPI documentation. Here's how to get it back.

spectree

spectree generates OpenAPI specs from your Pydantic models and route decorators. It works with Starlette, Flask, and raw ASGI applications. Add it to your router and it generates /docs and /redoc endpoints automatically.

Manual OpenAPI with PyYAML

For smaller APIs, maintaining an openapi.yaml by hand and serving it at /docs via Swagger UI (loaded from a CDN) is a perfectly valid approach. Less magic, full control.

Testing Your Frameworkless API

pytest + httpx

The combination of pytest and httpx's AsyncClient is the cleanest way to test ASGI applications:

import pytest
from httpx import AsyncClient, ASGITransport
from main import app

@pytest.mark.asyncio
async def test_get_users():
    async with AsyncClient(
        transport=ASGITransport(app=app), base_url="http://test"
    ) as client:
        response = await client.get("/users")
    assert response.status_code == 200
    assert "users" in response.json()

No running server required, full request/response lifecycle tested.

pytest-asyncio

Don't forget pytest-asyncio for marking async test functions. Set asyncio_mode = "auto" in your pytest.ini to avoid decorating every test.

Putting It All Together: A Minimal Stack

Here's a practical stack recommendation for a production-ready frameworkless REST API in 2026:

Install the essentials:

pip install uvicorn[standard] starlette pydantic[email] \
    sqlalchemy[asyncio] asyncpg pyjwt authlib \
    aiocache spectree pytest pytest-asyncio httpx

This stack gives you everything a FastAPI project would give you, but you understand exactly what every dependency does. When something breaks, you know where to look.

Honest Caveats

Going frameworkless isn't free. You'll spend more time wiring things together upfront. You'll write your own middleware for things FastAPI handles automatically. If your team has junior developers, a convention-heavy framework genuinely reduces cognitive load and mistakes.

Use this approach when:

• You have a clear, bounded service
• Performance is a real requirement, not a premature optimization
• Your team is comfortable owning infrastructure decisions
• You want to avoid framework upgrade pain

Reach for FastAPI (or even Django REST Framework) when:

• You're moving fast and need conventions
• Your team is less experienced with async Python
• You need admin interfaces, auth flows, and CRUD scaffolding

Final Thoughts

The Python ecosystem in 2026 has never been better for composable API development. Libraries like Pydantic v2 and Starlette's routing primitives are genuinely production-grade components, not toys. The "no framework" approach isn't a rejection of FastAPI or Django — it's a recognition that those frameworks are themselves built from composable libraries, and sometimes you want to start one level lower.

Ready to build your first frameworkless API? Start with the minimal stack above, pick one endpoint to implement end-to-end, and run your tests. The architecture clarity you gain in that first hour will pay dividends for the life of the service.

If you found this useful, share it with your team or drop it in your Slack channel for the next time someone asks "do we really need all of FastAPI for this?" — because sometimes the answer is no, and now you know what to reach for instead.