Flask Extensions — Top 25 Cheat Sheet

#	Extension	pip install	Purpose	Bucket	Tier
1	Flask-SQLAlchemy	Flask-SQLAlchemy	ORM integration (models, session, engine)	FS·API	T1
2	Flask-Migrate	Flask-Migrate	Alembic DB migrations via `flask db`	FS·API	T1
3	Flask-Login	Flask-Login	User session & login state	FS	T1
4	Flask-WTF	Flask-WTF	Forms, validation & CSRF	FS	T1
5	Flask-CORS	Flask-Cors	Cross-Origin Resource Sharing	API	T1
6	Flask-JWT-Extended	Flask-JWT-Extended	JWT access/refresh tokens	API	T1
7	flask-smorest	flask-smorest	REST API + auto OpenAPI/Swagger	API	T2
8	Flask-Marshmallow	flask-marshmallow	Object serialization/deserialization	API	T2
9	Flask-Caching	Flask-Caching	View/function response caching	API·OPS	T2
10	Flask-Limiter	Flask-Limiter	Rate limiting	API·OPS	T2
11	Flask-Mail	Flask-Mail	SMTP email sending	FS	T2
12	Flask-SocketIO	Flask-SocketIO	WebSocket / real-time events	FS·API	T2
13	Flask-Bcrypt	Flask-Bcrypt	bcrypt password hashing	FS	T2
14	Flask-Session	Flask-Session	Server-side session store	FS	T2
15	Flask-Admin	Flask-Admin	Auto CRUD admin interface	FS	T3
16	Flask-Security	Flask-Security	Full auth suite (roles/2FA/reset)	FS	T3
17	Flask-Talisman	flask-talisman	HTTPS + CSP/HSTS security headers	FS·API	T3
18	Flask-APScheduler	Flask-APScheduler	In-process cron/interval jobs	OPS	T3
19	Flask-Executor	Flask-Executor	Background threads/processes	API·OPS	T3
20	Authlib	Authlib	OAuth 1/2 & OIDC client/server	FS·API	T3
21	Flask-Compress	Flask-Compress	Response compression	API	T3
22	Flask-Babel	Flask-Babel	i18n / l10n (translations)	FS	T3
23	Flask-DebugToolbar	Flask-DebugToolbar	In-browser debug panels	dev	T3
24	Connexion	connexion[flask]	Spec-first API from OpenAPI	API	T3
25	Strawberry GraphQL	strawberry-graphql[flask]	GraphQL endpoint	API	T3

101Extensions 101 — the shared patterninit, factory, config

pip install Flask-Thing★
Distribution names are usually Flask-Xxx; the import is lower-snake, e.g. from flask_login import LoginManager.
ext = Thing(app)
The simple, single-app form — construct the extension with the app directly.
ext = Thing() def create_app(): app = Flask(__name__) ext.init_app(app) return app★
The application-factory pattern: build the extension at module scope, bind it inside the factory with init_app(). Preferred for testing, blueprints & multiple configs — used throughout this sheet.
app.config["SECRET_KEY"] = ...
Most extensions read app.config keys (uppercase). Set them before init_app() / first request; a SECRET_KEY is required for sessions, CSRF and signing.
with app.app_context(): ...
Outside a request (scripts, CLI, background jobs) you need an app context for current_app, DB sessions, etc.
one extension object, one init_app per appgotcha
Don't call the extension's constructor with the app and init_app(); pick one. With the factory, never share request-scoped state at module level.

1Flask-SQLAlchemyFSAPIv3.1.1 · SA 2.0

db = SQLAlchemy(model_class=Base) · db.init_app(app)★
pip install Flask-SQLAlchemy. v3.1 requires SQLAlchemy ≥2.0.16 and supports the 2.0 declarative style via model_class.
app.config["SQLALCHEMY_DATABASE_URI"] = "postgresql+psycopg://..."
The one required setting. SQLALCHEMY_ENGINE_OPTIONS for pool tuning; SQLALCHEMY_BINDS for multiple databases.
class User(db.Model): id = db.mapped_column(db.Integer, primary_key=True)
db.Model is the declarative base; db.session, db.engine, and all SA types hang off db.
db.session.execute(db.select(User).where(...)).scalars()★
SA 2.0 query style. db.get_or_404() / db.paginate() are handy Flask-specific helpers.
Query.get() / Model.querylegacy
The old Model.query / Query.get() Django-ish API is legacy in SA 2.0 — prefer select() + db.session.execute(). Model changes need an app context.

2Flask-MigrateFSAPIv4.x · Alembic

migrate = Migrate() · migrate.init_app(app, db)★
pip install Flask-Migrate. Wraps Alembic and wires it into the flask CLI. Pass the same db object.
flask db init
Create the migrations/ folder once per project.
flask db migrate -m "add users"★
Autogenerate a revision by diffing models vs the DB. Always read the generated script — autogenerate misses some changes.
flask db upgrade · flask db downgrade★
Apply / roll back. flask db stamp head marks an existing DB as current without running migrations.
autogenerate blind spotsgotcha
Column renames, server defaults, and some type changes aren't detected — edit the revision by hand. Ensure models are imported before migrate runs.

3Flask-LoginFSv0.6.3

login_manager = LoginManager() · login_manager.init_app(app)★
pip install Flask-Login. Manages the logged-in user in the session. Set login_manager.login_view = "auth.login".
@login_manager.user_loader def load_user(user_id): return db.session.get(User, int(user_id))★
Required callback: turn the stored id back into a user object. Your User should subclass UserMixin.
login_user(user, remember=True) · logout_user()
Call on successful password check / on logout.
@login_required · current_user★
Protect a view; current_user is a proxy to the logged-in user (or AnonymousUserMixin).
needs SECRET_KEY · not authorizationgotcha
Sessions are signed with SECRET_KEY. Flask-Login handles authentication only — role/permission checks are your job (or use Flask-Security).

4Flask-WTFFSv1.3.0

class LoginForm(FlaskForm): email = StringField(validators=[DataRequired(), Email()])★
pip install Flask-WTF. Wraps WTForms with CSRF, file uploads and i18n.
if form.validate_on_submit(): ...★
True on a POST that passes validation — the canonical view idiom. Renders errors into form.field.errors.
CSRFProtect(app) · {{ form.csrf_token }}★
Enable app-wide CSRF; drop the hidden token into every form (or form.hidden_tag()).
file = FileField(validators=[FileAllowed(["jpg","png"])])
FileRequired / FileAllowed validate uploads; the file is in form.file.data.
SECRET_KEY + WTF_CSRF_TIME_LIMITgotcha
CSRF needs SECRET_KEY. For pure-JSON APIs, either exempt routes (@csrf.exempt) or send the token header — don't silently disable CSRF app-wide.

5Flask-CORSAPIv6.0.x

CORS(app)★
pip install Flask-Cors (note the -Cors spelling). Bare form allows all origins — fine for dev, too open for prod.
CORS(app, resources={r"/api/*": {"origins": ["https://app.example.com"]}})★
Scope CORS to path patterns and explicit origins — the recommended prod configuration.
@cross_origin(origins=[...])
Per-view decorator when you only need CORS on a couple of endpoints.
supports_credentials=True
Needed to allow cookies/Authorization across origins — and then you cannot use origins="*".
keep it current (CVE history)security
Flask-Cors had several 2024 CVEs (path-matching & regex handling). Pin a recent 6.x, and never reflect arbitrary origins with credentials enabled.

6Flask-JWT-ExtendedAPIv4.7.4

jwt = JWTManager(app)★
pip install Flask-JWT-Extended. Set app.config["JWT_SECRET_KEY"]. Supports access + refresh tokens, cookies or headers.
token = create_access_token(identity=user.id)★
Issue a JWT on login; create_refresh_token() for the long-lived refresh flow.
@jwt_required() · @jwt_required(refresh=True)★
Protect endpoints; the refresh variant guards the token-refresh route. @jwt_required(optional=True) for mixed public/private.
uid = get_jwt_identity() · current_user
Read the identity inside a protected view. Register @jwt.user_lookup_loader to make current_user return your ORM object.
token revocation is opt-ingotcha
JWTs are stateless — logout/blocklist needs a @jwt.token_in_blocklist_loader backed by Redis/DB. Set sensible JWT_ACCESS_TOKEN_EXPIRES.

7flask-smorestAPIv0.47.0

api = Api(app) · blp = Blueprint("pets", __name__, url_prefix="/pets")★
pip install flask-smorest. Marshmallow-based REST framework; auto-generates OpenAPI + a Swagger-UI / ReDoc page.
@blp.route("/") @blp.arguments(PetSchema) @blp.response(201, PetSchema) def post(self, new_data): ...★
@blp.arguments validates & injects the parsed body; @blp.response serializes and documents the status/schema.
app.config["API_TITLE"], ["OPENAPI_VERSION"] = "3.0.3"
Config drives the spec; the docs UI mounts at OPENAPI_SWAGGER_UI_PATH. Register blueprints with api.register_blueprint(blp).
@blp.paginate() · abort(404, message=...)
Built-in pagination and consistent error responses.
alt: Flask-RESTXchoose one
Flask-RESTX (Api/Namespace/@api.route/marshal_with) is the reflection-based alternative. Flask-RESTful is discouraged for new code (see deprecated table).

8Flask-MarshmallowAPIv1.5.0

ma = Marshmallow() · ma.init_app(app)★
pip install flask-marshmallow. Thin Flask layer over marshmallow; pairs with Flask-SQLAlchemy (install marshmallow-sqlalchemy too).
class UserSchema(ma.SQLAlchemyAutoSchema): class Meta: model = User; load_instance = True★
Auto-derive fields from an ORM model. SQLAlchemySchema for explicit control.
UserSchema().dump(user) · UserSchema().load(request.json)★
dump = object→dict (serialize); load = dict→validated object. Add many=True for lists.
ma.Hyperlinks · ma.URLFor
Emit hypermedia links to other routes in the output.
marshmallow 3→4 field changesgotcha
Validation raises ValidationError — catch it (or let flask-smorest do so). Keep marshmallow & marshmallow-sqlalchemy versions aligned.

9Flask-CachingAPIOPSv2.4.1

cache = Cache(config={"CACHE_TYPE": "RedisCache"}) · cache.init_app(app)★
pip install Flask-Caching. Backends: SimpleCache, RedisCache, MemcachedCache, FileSystemCache.
@cache.cached(timeout=60)★
Cache a view's response by request path. Add query_string=True to vary on the query.
@cache.memoize(timeout=300)★
Cache a function's return keyed by its arguments — for expensive helpers, not just views.
cache.delete_memoized(fn, arg) · cache.clear()
Targeted invalidation. cache.set/get for manual key/value use.
stale data & per-user pagesgotcha
Don't @cache.cached responses that vary per user unless you key on identity — you'll serve one user's page to another.

10Flask-LimiterAPIOPSv4.1.x

limiter = Limiter(key_func=get_remote_address, default_limits=["200/day","50/hour"])★
pip install Flask-Limiter. limiter.init_app(app). Now v4.x — API broadly compatible with 3.x docs.
@limiter.limit("5 per minute")★
Per-route override. Also @limiter.exempt to skip a route, and shared_limit across routes.
storage_uri="redis://localhost:6379"★
Use a shared store (Redis/Memcached) in production — the default in-memory store is per-process and resets on restart.
key_func = lambda: get_jwt_identity()
Limit per authenticated user instead of per IP by swapping the key function.
in-memory storage in prodgotcha
With multiple workers/instances, in-memory counters don't share state — limits become per-worker. Always set storage_uri behind a load balancer.

11Flask-MailFSv0.10.0

mail = Mail() · mail.init_app(app)★
pip install Flask-Mail (now maintained under pallets-eco). SMTP email from views & scripts.
MAIL_SERVER, MAIL_PORT, MAIL_USE_TLS, MAIL_USERNAME, MAIL_PASSWORD★
Config keys for the SMTP connection; set MAIL_DEFAULT_SENDER to avoid repeating it.
msg = Message("Hi", recipients=["a@b.com"], body="...")
Build the message; set msg.html for HTML, msg.attach(...) for files.
mail.send(msg)★
Sends synchronously. Use mail.connect() as a context manager to batch several sends over one connection.
blocks the requestgotcha
SMTP is slow — sending inside a request stalls it. Offload to a background task (Flask-Executor / Celery / APScheduler) for anything user-facing.

12Flask-SocketIOFSAPIv5.x

socketio = SocketIO() · socketio.init_app(app)★
pip install Flask-SocketIO. Bidirectional Socket.IO events over WebSocket (with long-poll fallback).
@socketio.on("message") def handle(data): emit("reply", data, broadcast=True)★
Register event handlers; emit() sends back, join_room()/emit(..., to=room) for rooms.
socketio.run(app, host="0.0.0.0")★
Use this runner (not app.run) in dev so the WebSocket server starts.
message_queue="redis://"
Required to broadcast across multiple worker processes/servers.
async worker must matchgotcha
async_mode is threading, eventlet or gevent. eventlet is no longer maintained — prefer threading or gevent, and run gunicorn with the matching worker class (e.g. -k gevent).

13Flask-BcryptFSv1.0.1

bcrypt = Bcrypt() · bcrypt.init_app(app)★
pip install Flask-Bcrypt. bcrypt password hashing with a Flask-friendly API.
pw_hash = bcrypt.generate_password_hash(pw).decode()★
Salted bcrypt hash; store the string. BCRYPT_LOG_ROUNDS tunes cost (default 12).
bcrypt.check_password_hash(pw_hash, candidate)★
Constant-time verify at login — returns bool.
72-byte limitgotcha
bcrypt silently truncates passwords beyond 72 bytes. For new apps, Werkzeug's built-in generate_password_hash (scrypt/pbkdf2) or Argon2 are also solid choices.

14Flask-SessionFSv0.8.0

Session(app) or sess = Session(); sess.init_app(app)★
pip install Flask-Session. Moves session data server-side instead of the default signed cookie — needed for large or sensitive sessions.
app.config["SESSION_TYPE"] = "redis"★
Backends include redis, memcached, sqlalchemy, mongodb, and cachelib. Point SESSION_REDIS at your client.
session["user_id"] = 42
The normal Flask session dict — only the storage changes, your code doesn't.
SESSION_TYPE="filesystem" deprecatedv0.7+
The filesystem type was deprecated in 0.7.0 — use cachelib with a FileSystemCache instead. Still set SECRET_KEY (the session id cookie is signed).

15Flask-AdminFSv2.2.0

admin = Admin(app, name="Dashboard", template_mode="bootstrap4")★
pip install Flask-Admin. Auto CRUD UI over your models. v2.0 (Oct 2025) was a major rewrite — check the migration notes if upgrading from 1.x.
admin.add_view(ModelView(User, db.session))★
One line gives list/create/edit/delete for a model. Subclass ModelView to set column_list, form_columns, filters, etc.
class SecureView(ModelView): def is_accessible(self): return current_user.is_authenticated★
Override is_accessible() / inaccessible_callback() to gate the admin behind auth.
unsecured by defaultgotcha
Out of the box the admin is wide open — always add access control before deploying. Pairs naturally with Flask-Login or Flask-Security.

16Flask-SecurityFSv5.8.x

datastore = SQLAlchemyUserDatastore(db, User, Role) · Security(app, datastore)★
pip install Flask-Security. Batteries-included auth: login, registration, roles, password reset, confirmation, MFA/TOTP, WebAuthn.
@auth_required() · @roles_required("admin") · @roles_accepted(...)★
Authorization decorators on top of Flask-Login sessions and/or tokens.
User(UserMixin) · Role(RoleMixin)
Use the provided mixins; it ships the login/register/reset views & templates for you.
was "Flask-Security-Too"renamed
The maintained fork merged back into pallets-eco and is now published as Flask-Security again (same release on both PyPI names). Don't install the old abandoned original.

17Flask-TalismanFSAPIHTTPS + CSP

Talisman(app)★
pip install flask-talisman. Sets HTTP security headers and forces HTTPS. Default CSP is default-src 'self'; object-src 'none'.
Talisman(app, content_security_policy={"default-src": "'self'"})★
Customize the CSP; force_https, strict_transport_security (HSTS) and frame_options are toggles.
csp_nonce_in=["script-src"] · {{ csp_nonce() }}
Use per-request nonces for inline scripts instead of 'unsafe-inline'.
force_https breaks health checks behind a proxygotcha
Behind a load balancer that terminates TLS, set force_https=False (or trust X-Forwarded-Proto via ProxyFix) so internal HTTP probes aren't redirected.

18Flask-APSchedulerOPSv1.13.x

scheduler = APScheduler() · scheduler.init_app(app) · scheduler.start()★
pip install Flask-APScheduler. In-process cron/interval jobs with a Flask app context.
@scheduler.task("cron", id="nightly", hour=3)★
Decorate a function as a job; also "interval" (seconds/minutes) and "date" triggers. Jobs run inside scheduler.app.app_context().
scheduler.add_job(...) · SCHEDULER_API_ENABLED = True
Add jobs programmatically; the optional REST API lists/pauses/runs jobs.
pins APScheduler 3.x · multi-worker duplicationgotcha
v1.13 requires APScheduler 3.x (v4 not yet supported). With multiple gunicorn workers each starts its own scheduler — run it in one process, or use Celery-beat / an external scheduler for HA.

19Flask-ExecutorAPIOPSv1.0.0

executor = Executor(app)★
pip install Flask-Executor. A concurrent.futures pool that propagates app & request context into the worker.
future = executor.submit(do_work, arg)★
Fire a background thread/process and get a Future. EXECUTOR_TYPE = "thread"|"process", EXECUTOR_MAX_WORKERS.
executor.map(fn, iterable) · future.result()
Parallel map; add_done_callback() to react when a task finishes. submit_stored() keeps futures by key.
in-process, dies with the workergotcha
Great for short, fire-and-forget work; tasks are lost on restart and don't scale across machines. For durable/distributed queues use Celery or RQ.

20Authlib (Flask)FSAPIv1.7.x

oauth = OAuth(app)★
pip install Authlib. OAuth 1.0/2.0 & OpenID Connect — both client (log in with Google/GitHub) and provider sides. The modern replacement for Flask-OAuthlib.
oauth.register("google", client_id=..., server_metadata_url=..., client_kwargs={"scope": "openid email"})★
Register each provider once; OIDC discovery fills in the endpoints.
return oauth.google.authorize_redirect(redirect_uri)
Kick off the login; in the callback: token = oauth.google.authorize_access_token(), then read token["userinfo"].
state/session requiredgotcha
The OAuth flow stores state in the Flask session — needs SECRET_KEY and cookies that survive the redirect (watch SameSite). Register the exact redirect_uri with the provider.

21Flask-CompressAPIv1.17

compress = Compress() · compress.init_app(app)★
pip install Flask-Compress. Transparently compresses responses with gzip, deflate, brotli or zstd based on Accept-Encoding.
COMPRESS_MIMETYPES = ["text/html", "application/json", ...]
Which content types to compress; COMPRESS_MIN_SIZE skips tiny payloads; COMPRESS_LEVEL / COMPRESS_BR_LEVEL tune ratio vs CPU.
install brotli / zstandard for those algorithms
Brotli/zstd need their optional libraries present; otherwise it falls back to gzip.
let the proxy do it?note
If nginx/Cloudflare already compresses, doing it again in Flask wastes CPU. Use this when the app serves responses directly.

22Flask-BabelFSv4.0.0

babel = Babel(app, locale_selector=get_locale)★
pip install Flask-Babel. i18n/l10n built on Babel & pytz — translations, dates, numbers, currencies.
from flask_babel import gettext as _ flash(_("Saved!"))★
Wrap user-facing strings in _() / gettext(); ngettext() for plurals; {{ _("...") }} in templates.
pybabel extract -o messages.pot . → init → compile★
Workflow: extract strings, init -l fr a catalog, translate the .po, then compile to .mo.
locale_selector runs per requestgotcha
Return the locale from the user/session/Accept-Language; forgetting to compile catalogs means you always see the source language.

23Flask-DebugToolbardevv0.16.0

toolbar = DebugToolbarExtension(app)★
pip install Flask-DebugToolbar (now pallets-eco). Injects an in-page panel with request, config, template & SQLAlchemy query timing.
app.debug = True · SECRET_KEY set★
Only active in debug mode. The SQLAlchemy panel shows every query & its duration — great for spotting N+1s.
DEBUG_TB_INTERCEPT_REDIRECTS = False
Common tweak so redirects aren't paused by the toolbar.
never enable in productiongotcha
It exposes config & internals and only renders on HTML responses. Keep it strictly dev-only.

24ConnexionAPIv3.x · spec-first

app = connexion.FlaskApp(__name__)★
pip install "connexion[flask]". Spec-first: write OpenAPI, and Connexion routes, validates & documents automatically. v3 is an ASGI rewrite.
app.add_api("openapi.yaml")★
The operationId in each path maps to a Python function; request/response are validated against the schema. Swagger UI is served automatically.
connexion.AsyncApp(__name__)
Use FlaskApp to keep the Flask ecosystem, or AsyncApp for pure-ASGI async. Run with uvicorn.
v2 → v3 is a big changegotcha
Connexion 3 became an ASGI middleware stack — app construction, error handling and middleware differ from 2.x. Serve via an ASGI server (or the built-in runner), not plain flask run.

25Strawberry GraphQLAPIcode-first

@strawberry.type class Query: ... · schema = strawberry.Schema(Query)★
pip install "strawberry-graphql[flask]". Type-annotation / code-first GraphQL. (Ariadne is the schema-first alternative.)
app.add_url_rule("/graphql", view_func=GraphQLView.as_view("graphql", schema=schema))★
Mount the sync view; AsyncGraphQLView has the same interface for async resolvers.
GraphiQL IDE at /graphql
The view serves the in-browser GraphiQL explorer by default (disable with graphiql=False in prod).
one endpoint, guard depth/complexitygotcha
GraphQL exposes a single POST endpoint — add query-depth/complexity limits and auth in resolvers/extensions to prevent abusive queries.

Avoid	Use instead	Why
Flask-RESTful	flask-smorest / Flask-RESTX	Maintenance-only; discouraged for new APIs. smorest/RESTX give OpenAPI + schema validation.
Flask-Security (original)	Flask-Security (pallets-eco)	The old mattupstate project was abandoned; the maintained fork (ex “Flask-Security-Too”) is now published as Flask-Security again.
Flask-OAuthlib	Authlib	Deprecated by its own author in favour of Authlib.
Flask-Script	built-in Flask CLI (click)	Custom commands now use `@app.cli.command()` / `flask`; Flask-Script is obsolete.
Flask-Testing	pytest + app.test_client()	Unmaintained; Flask's test client + pytest fixtures cover it.
Flask-Uploads	Flask-Reuploaded / custom	Original abandoned; Flask-Reuploaded is the drop-in maintained fork.
eventlet (SocketIO worker)	threading / gevent	eventlet is no longer actively maintained; prefer threading or gevent async modes.

flask — extensions cheat sheet

Outline — jump to any extension

Tier 1 · essential

Reference

Tier 2 · very common

Tier 3 · useful / specialized

Tier 1 — Essential

Tier 2 — Very Common

Tier 3 — Useful / Specialized

Deprecated / Avoid — use instead

Worth memorizing