Flask Cheat Sheet

Updated 2026-07-29

Next Topic: Full-Stack Application Deployment Cheat Sheet

🎯Take a practice test on this topic8 practice tests · 232 questions→

🧠Study flashcards on this topic133 cards · spaced repetition→

Flask is a lightweight WSGI web framework for Python, designed to make getting started quick and easy while providing the flexibility to scale to complex applications. Unlike full-stack frameworks, Flask is intentionally minimalist — it provides core functionality for routing, requests, and templating, then lets you choose extensions for databases, authentication, and other features. As of Flask 3.x, the framework supports async views natively, class-based views via MethodView, secret key rotation, and improved configuration patterns including environment prefix loading. This modular approach makes Flask particularly well-suited for microservices, REST APIs, and projects where you want full control over the architecture without unnecessary abstractions.

What This Cheat Sheet Covers

This topic spans 24 focused tables and 193 indexed concepts, 133 flashcards, 8 practice tests with 232 questions. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: Application Setup and ConfigurationTable 2: Routing and URL RulesTable 3: Request HandlingTable 4: Response ObjectsTable 5: Templates and Jinja2Table 6: Sessions and CookiesTable 7: Error HandlingTable 8: Blueprints and Application StructureTable 9: Database IntegrationTable 10: Request Lifecycle HooksTable 11: Application Context and GlobalsTable 12: TestingTable 13: CLI and Custom CommandsTable 14: Security FeaturesTable 15: Extensions and MiddlewareTable 16: Asynchronous SupportTable 17: Streaming and Real-TimeTable 18: Logging and DebuggingTable 19: File UploadsTable 20: SignalsTable 21: Deployment and ProductionTable 22: Class-Based ViewsTable 23: Message FlashingTable 24: Static Files

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

Table 1: Application Setup and Configuration

Everything starts with the Flask object, the central application instance that ties routing, requests, and config together. These entries cover how you create that instance, run the development server, and load settings from classes, files, or the environment, plus the security sensitive knobs like SECRET_KEY and DEBUG. The init_app() factory pattern near the end is what lets larger apps stay testable and spin up multiple instances cleanly.

Method	Example	Description
Flask app instance	`app = Flask(__name__)`	• Creates the core application object • `__name__` helps Flask locate resources and templates relative to the module.
app.run()	`app.run(debug=True, port=5000)`	• Starts the development server with optional debug mode and custom port • the `flask run` CLI command is the recommended way to launch it instead.
config.from_object()	`app.config.from_object('config.DevelopmentConfig')`	Loads only the uppercase attributes from a class or module, never a plain dict.
config.from_envvar()	`app.config.from_envvar('APP_SETTINGS')`	Loads a config file whose path is named by an environment variable, a shortcut for `from_pyfile(os.environ[...])`.
config.from_prefixed_env()	`app.config.from_prefixed_env(prefix='FLASK_')`	Reads environment variables directly, loading every variable that starts with the prefix (default `FLASK_`).
config.from_file()	`app.config.from_file('config.json', load=json.load)`	Loads config from any file format using a callable parser you pass in (`json.load`, `tomllib.load`, etc).
app.secret_key	`app.secret_key = 'your-secret-key'` `# or app.config['SECRET_KEY']`	• Sets the secret key used to sign session cookies and CSRF tokens • signs, does not encrypt, so must be random and kept secure.
app.debug	`app.debug = True`	• Enables debug mode: interactive debugger, automatic reload, and detailed error pages • unreliable if set in code, prefer `--debug` or `FLASK_DEBUG`.
app.testing	`app.config['TESTING'] = True`	Enables testing mode, which propagates exceptions to your test runner instead of the app's error handlers.
init_app() pattern	`db = SQLAlchemy()` `def create_app():` `db.init_app(app)`	• Defers extension initialization until an app instance is available • enables the application factory pattern and reusing one extension across multiple apps.
PROPAGATE_EXCEPTIONS	`app.config['PROPAGATE_EXCEPTIONS'] = True`	• Forces exceptions to be re-raised instead of handled by error handlers • implicitly `True` when `TESTING` or `DEBUG` is enabled.
SERVER_NAME	`app.config['SERVER_NAME'] = 'example.com:5000'`	Sets the hostname and port used by `url_for()` outside a request context, it does not restrict which hosts Flask accepts requests from.
APPLICATION_ROOT	`app.config['APPLICATION_ROOT'] = '/app'`	Sets the URL prefix for generating URLs outside a request context, inside a real request the dispatcher sets `SCRIPT_NAME` instead.
PREFERRED_URL_SCHEME	`app.config['PREFERRED_URL_SCHEME'] = 'https'`	Sets the URL scheme (`http` or `https`) used by `url_for()` when building external URLs outside a request context.
SECRET_KEY_FALLBACKS	`app.config['SECRET_KEY_FALLBACKS'] = ['old-key']`	• List of old secret keys still accepted for unsigning (Flask 3.1+) • enables zero-downtime key rotation without an instant mass logout.

Table 2: Routing and URL Rules

Routing is how Flask maps a URL to the Python function that handles it. Beyond the everyday @app.route() decorator, this covers variable rules, type converters, and method restrictions for capturing dynamic URLs, plus url_for() for building links by endpoint name rather than hardcoding paths — the safer habit that survives URL changes. The custom-converter and preprocessor hooks at the bottom are the advanced escape hatches for when the built-in URL types aren't enough.

Decorator	Example	Description
@app.route()	`@app.route('/hello')` `def hello():` `return 'Hello'`	• Binds a URL pattern to a view function • supports multiple routes per function.

The rest of this section is part of the full cheat sheet

Table 3: Request Handling

The global request object is your window into whatever the client sent — query strings, form fields, JSON bodies, uploaded files, headers, and cookies all hang off it. A recurring distinction worth internalizing: bracket access like request.form['x'] raises if the key is missing, while .get('x') returns None or a default, so reach for .get() whenever input might be absent.

Object	Example	Description
request.method	`if request.method == 'POST':`	Returns the HTTP method (`GET`, `POST`, `PUT`, `DELETE`, etc.) used for the current request.

The rest of this section is part of the full cheat sheet

Table 4: Response Objects

Flask is flexible about what a view can return: a plain string, a (body, status) tuple, or a dict it auto-jsonifies. When you need more control over headers, cookies, or MIME type, you build a proper Response with make_response() or the constructor. This table also gathers the helpers for redirects, aborting with an HTTP error, streaming, and sending files for download.

Method	Example	Description
String return	`return 'Hello World'`	Returns a plain text response with status code 200 by default.

The rest of this section is part of the full cheat sheet

Table 1: Application Setup and Configuration

Method	Example	Description
Flask app instance	`app = Flask(__name__)`	• Creates the core application object • `__name__` helps Flask locate resources and templates relative to the module.
app.run()	`app.run(debug=True, port=5000)`	• Starts the development server with optional debug mode and custom port • the `flask run` CLI command is the recommended way to launch it instead.
config.from_object()	`app.config.from_object('config.DevelopmentConfig')`	Loads only the uppercase attributes from a class or module, never a plain dict.
config.from_envvar()	`app.config.from_envvar('APP_SETTINGS')`	Loads a config file whose path is named by an environment variable, a shortcut for `from_pyfile(os.environ[...])`.
config.from_prefixed_env()	`app.config.from_prefixed_env(prefix='FLASK_')`	Reads environment variables directly, loading every variable that starts with the prefix (default `FLASK_`).
config.from_file()	`app.config.from_file('config.json', load=json.load)`	Loads config from any file format using a callable parser you pass in (`json.load`, `tomllib.load`, etc).
app.secret_key	`app.secret_key = 'your-secret-key'` `# or app.config['SECRET_KEY']`	• Sets the secret key used to sign session cookies and CSRF tokens • signs, does not encrypt, so must be random and kept secure.
app.debug	`app.debug = True`	• Enables debug mode: interactive debugger, automatic reload, and detailed error pages • unreliable if set in code, prefer `--debug` or `FLASK_DEBUG`.
app.testing	`app.config['TESTING'] = True`	Enables testing mode, which propagates exceptions to your test runner instead of the app's error handlers.
init_app() pattern	`db = SQLAlchemy()` `def create_app():` `db.init_app(app)`	• Defers extension initialization until an app instance is available • enables the application factory pattern and reusing one extension across multiple apps.
PROPAGATE_EXCEPTIONS	`app.config['PROPAGATE_EXCEPTIONS'] = True`	• Forces exceptions to be re-raised instead of handled by error handlers • implicitly `True` when `TESTING` or `DEBUG` is enabled.
SERVER_NAME	`app.config['SERVER_NAME'] = 'example.com:5000'`	Sets the hostname and port used by `url_for()` outside a request context, it does not restrict which hosts Flask accepts requests from.
APPLICATION_ROOT	`app.config['APPLICATION_ROOT'] = '/app'`	Sets the URL prefix for generating URLs outside a request context, inside a real request the dispatcher sets `SCRIPT_NAME` instead.
PREFERRED_URL_SCHEME	`app.config['PREFERRED_URL_SCHEME'] = 'https'`	Sets the URL scheme (`http` or `https`) used by `url_for()` when building external URLs outside a request context.
SECRET_KEY_FALLBACKS	`app.config['SECRET_KEY_FALLBACKS'] = ['old-key']`	• List of old secret keys still accepted for unsigning (Flask 3.1+) • enables zero-downtime key rotation without an instant mass logout.

Table 2: Routing and URL Rules

Decorator	Example	Description
@app.route()	`@app.route('/hello')` `def hello():` `return 'Hello'`	• Binds a URL pattern to a view function • supports multiple routes per function.

Table 3: Request Handling

Object	Example	Description
request.method	`if request.method == 'POST':`	Returns the HTTP method (`GET`, `POST`, `PUT`, `DELETE`, etc.) used for the current request.

Table 4: Response Objects

Method	Example	Description
String return	`return 'Hello World'`	Returns a plain text response with status code 200 by default.