DEV Community

Cover image for I built a free full-stack auth starter so you can skip "auth week" (Flutter + FastAPI)
Yusuf kızılkan
Yusuf kızılkan

Posted on

I built a free full-stack auth starter so you can skip "auth week" (Flutter + FastAPI)

#flutter #fastapi #opensource #android

Every side project I've started died a little during the same seven days: auth week.

You know the drill. Login screen, register screen, forgot password. JWT access tokens, refresh tokens, where do I even store these securely? Then the Google Sign-In configuration maze — SHA-1 fingerprints, two different client IDs, the OAuth consent screen. A week of boring, error-prone work before you write a single line of your actual product.

So I built the whole thing once, properly, and released it free.

What's inside

Flutter side:

  • Login, Register, Forgot Password and Auth Gate screens (light/dark themes, follows system)
  • Email/password + Google Sign-In, fully wired
  • JWT access + refresh tokens in flutter_secure_storage
  • Automatic refresh on 401 — expired tokens refresh silently, and the user only gets logged out if the refresh itself fails
  • Riverpod + go_router, clean feature-based architecture

Backend side (the part most starters skip):

  • FastAPI + PostgreSQL with /auth/register, /login, /refresh, /forgot-password, /me, /google
  • bcrypt password hashing, short-lived access tokens, rotating refresh tokens
  • Starts with one command: docker compose up
  • Interactive API docs at /docs out of the box (thanks, FastAPI)

Why full-stack?

Most free auth templates give you beautiful screens and leave the backend as "an exercise for the reader." Which means auth week isn't actually over — you just moved it.

This starter runs end to end: clone → docker compose up → flutter run → sign in. Real Postgres, real tokens, real error handling (wrong password shows a clean error banner, not a crash).

Two gotchas I hit (so you don't have to)

1. Non-ASCII Windows paths break the Flutter build. My desktop folder is Masaüstü (Turkish Windows). Gradle and Flutter's shader compiler choke on the ü. If your Windows is in Turkish, German, Spanish... and your project lives under a localized path, you'll hit this too. The fix (subst a drive letter + android.overridePathCheck=true) is documented in the repo's FAQ.

2. flutter_secure_storage needs minSdk 23+. Recent versions silently require it; older project templates default lower and the build fails with a confusing error. Bump minSdk to 23 and compileSdk to 36.

Links

This starter is the foundation of a full SaaS kit I'm building in public — subscriptions (RevenueCat), push notifications, Apple Sign-In, admin panel. Star the repo if you want to follow along.

I'd genuinely love feedback — especially on the token refresh flow and the folder structure. What does your auth week look like?

Top comments (0)