The latest articles on DEV Community by Yusuf kızılkan (@yusuf_kzlkan_bec8219b13). https://dev.to/yusuf_kzlkan_bec8219b13 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4052108%2F28b78e3d-fb00-4a0e-82ce-2d5a77d46bed.png https://dev.to/yusuf_kzlkan_bec8219b13 en Yusuf kızılkan Tue, 28 Jul 2026 23:22:55 +0000 https://dev.to/yusuf_kzlkan_bec8219b13/i-built-a-free-full-stack-auth-starter-so-you-can-skip-auth-week-flutter-fastapi-4e51 https://dev.to/yusuf_kzlkan_bec8219b13/i-built-a-free-full-stack-auth-starter-so-you-can-skip-auth-week-flutter-fastapi-4e51 <p>Every side project I've started died a little during the same seven days: <strong>auth week.</strong></p> <p>You know the drill. Login screen, register screen, forgot password. JWT access tokens, refresh tokens, where do I even store these securely? Then the Google Sign-In configuration maze — SHA-1 fingerprints, two different client IDs, the OAuth consent screen. A week of boring, error-prone work before you write a single line of your actual product.</p> <p>So I built the whole thing once, properly, and released it free.</p> <h2> What's inside </h2> <p><strong>Flutter side:</strong></p> <ul> <li>Login, Register, Forgot Password and Auth Gate screens (light/dark themes, follows system)</li> <li>Email/password + Google Sign-In, fully wired</li> <li>JWT access + refresh tokens in <code>flutter_secure_storage</code> </li> <li>Automatic refresh on 401 — expired tokens refresh silently, and the user only gets logged out if the refresh itself fails</li> <li>Riverpod + go_router, clean feature-based architecture</li> </ul> <p><strong>Backend side (the part most starters skip):</strong></p> <ul> <li>FastAPI + PostgreSQL with <code>/auth/register</code>, <code>/login</code>, <code>/refresh</code>, <code>/forgot-password</code>, <code>/me</code>, <code>/google</code> </li> <li>bcrypt password hashing, short-lived access tokens, rotating refresh tokens</li> <li>Starts with one command: <code>docker compose up</code> </li> <li>Interactive API docs at <code>/docs</code> out of the box (thanks, FastAPI)</li> </ul> <h2> Why full-stack? </h2> <p>Most free auth templates give you beautiful screens and leave the backend as "an exercise for the reader." Which means auth week isn't actually over — you just moved it.</p> <p>This starter runs end to end: clone → <code>docker compose up</code> → <code>flutter run</code> → sign in. Real Postgres, real tokens, real error handling (wrong password shows a clean error banner, not a crash).</p> <h2> Two gotchas I hit (so you don't have to) </h2> <p><strong>1. Non-ASCII Windows paths break the Flutter build.</strong> My desktop folder is <code>Masaüstü</code> (Turkish Windows). Gradle and Flutter's shader compiler choke on the <code>ü</code>. If your Windows is in Turkish, German, Spanish... and your project lives under a localized path, you'll hit this too. The fix (subst a drive letter + <code>android.overridePathCheck=true</code>) is documented in the repo's FAQ.</p> <p><strong>2. <code>flutter_secure_storage</code> needs minSdk 23+.</strong> Recent versions silently require it; older project templates default lower and the build fails with a confusing error. Bump <code>minSdk</code> to 23 and <code>compileSdk</code> to 36.</p> <h2> Links </h2> <ul> <li> <strong>GitHub (MIT licensed):</strong> <a href="https://github.com/yusufkizilkan/flutter-fastapi-auth-starter" rel="noopener noreferrer">https://github.com/yusufkizilkan/flutter-fastapi-auth-starter</a> </li> <li> <strong>3-minute setup video:</strong> <a href="https://www.youtube.com/watch?v=x1ByQMPEy8g" rel="noopener noreferrer">https://www.youtube.com/watch?v=x1ByQMPEy8g</a> </li> <li> <strong>Download on Gumroad</strong> (free, pay what you want): <a href="https://kizilkan2.gumroad.com/l/flutter-auth-starter" rel="noopener noreferrer">https://kizilkan2.gumroad.com/l/flutter-auth-starter</a> </li> </ul> <p>This starter is the foundation of a full SaaS kit I'm building in public — subscriptions (RevenueCat), push notifications, Apple Sign-In, admin panel. Star the repo if you want to follow along.</p> <p>I'd genuinely love feedback — especially on the token refresh flow and the folder structure. What does your auth week look like?</p> flutter fastapi opensource android