Async Python framework with batteries you actually need.
Auth, 2FA, WebAuthn, OAuth, WebSockets, admin dashboard, Vue 3 frontend. No build step, no third-party auth services. One codebase, you own everything.
STK makes SaaS apps legible, changeable, testable, and operable by agents.
git clone git@github.com:level09/stk.git && cd stk
./setup.sh # deps + secure .env
uv run stk create-db # database via Alembic
uv run stk install # admin user
uv run stk run # localhost:5000Most frameworks give you routing and leave the rest as homework. Auth alone eats weeks. Then you bolt on Clerk or Auth0, hand your users' credentials to a third party, and pay per-MAU for the privilege.
stk ships what actually matters:
You own your auth. Login, session management, TOTP 2FA (Google Authenticator, Authy, 1Password), WebAuthn passkeys (Touch ID, YubiKey), recovery codes, OAuth (Google, GitHub). Production code, not a tutorial. Your users' data stays on your server.
Async all the way down. Quart + async SQLAlchemy + aiosmtplib + native WebSockets. Not async bolted onto a sync framework. Real concurrency without threads, workers, or callback hell.
No JS build step. Vue 3 + Vuetify 4 loaded directly in the browser. No webpack, no vite, no node_modules, no npm. Delete your frontend toolchain. Still get a polished admin dashboard with data tables, dark mode, collapsible sidebar, 5000+ icons.
SQLite by default. Deploy anywhere. No managed database required. PostgreSQL when you need it, not when the framework demands it.
No Celery, no Redis (unless you want them). Background tasks run on asyncio. Session store works with cookies or Redis. Complexity is opt-in.
Built to be operated by agents. stk inspect reports routes, auth guards, models, and commands as JSON. stk verify and stk smoke are a real gate: lint, migration drift, and a real browser that fails on console errors and invisible text. The docs ship in the repo and the gate fails when they drift from the code.
Want payments? ReadyKit adds Stripe, multi-tenancy, and teams on top of stk.
- Auth and security: Argon2id passwords (12 char minimum), TOTP 2FA, passkeys as first or second factor, recovery codes, Google and GitHub OAuth with PKCE and verified emails, session tracking by IP and device, account lockout, per-IP rate limits shared across workers, CSRF on every mutation. Public sign-up is off by default.
- Admin dashboard: users, roles, and an activity audit log, with server-paginated tables and JSON APIs.
- Real-time: authenticated, origin-checked WebSockets that push to a named user and close when the session ends.
- Frontend: Vue 3 and Vuetify 4 with no build step, dark mode, collapsible sidebar, notifications, Tabler Icons.
- Tooling: one CLI,
stk: run, shell, new, db, doctor, verify, smoke, inspect, report, and user management. - Deploy: a one-command VPS script (Caddy, systemd, hardened OS) or Docker Compose with PostgreSQL, Redis, and Nginx.
| Layer | Tech |
|---|---|
| Runtime | Python 3.11+, uv |
| Web | Quart (async Flask) |
| ORM | SQLAlchemy 2.0+ async |
| Database | SQLite (default), PostgreSQL (optional) |
| Migrations | Alembic |
| Auth | quart-security (2FA, WebAuthn, OAuth) |
| Frontend | Vue 3, Vuetify 4, Axios |
| Server | Uvicorn (ASGI) behind Caddy or Nginx |
Everything else lives at docs.stk.dev, and in this repo at docs/src/content/docs/:
quick start, build loop, models, frontend, authentication, configuration, CLI reference, deployment, and working with agents. Upgrade notes are in CHANGELOG.md; the production security contract is SECURITY.md.
MIT