HTTP facade

Some fleets must not hold database credentials. Mount the optional FastAPI sub-app in your API process:

from fastapi import FastAPI
from taskq.http import (
    ClaimWaitHub,
    TaskqFacadeTransports,
    create_taskq_app,
    static_api_key_auth,
)

taskq_app = create_taskq_app(
    TaskqFacadeTransports(
        producer=producer_transport,
        runner=runner_transport,
        observer=observer_transport,
        authorization=authorization_transport,
        claim_wait_hub=ClaimWaitHub(),
    ),
    authorizer=static_api_key_auth("secret"),
    # optional: operator_transport=…, operator_authorizer=… together
)

host = FastAPI()
host.mount("/taskq", taskq_app)
# Wire paths live under /taskq/v1/...

Requires outlabs-taskq[http].

Auth is injected

A QueueAuthorizer is required. Built-ins in taskq.http:

• static_api_key_auth
• bearer_token_auth
• callable_auth
• legacy_taskq_auth
• no_auth_for_tests (tests only)

OutLabs IAM: OutlabsQueueAuthorizer from taskq.http.outlabs ([outlabs] extra). See Authorization.

Topology rules

• HTTP workers use taskq --context NAME worker run; the context carries the base URL and bearer-token environment-variable name, never the token.
• HTTP workers must not use LISTEN.
• Claim-wait and an optional embedded worker can belong on the facade host via TaskqRuntime / taskq_lifespan.
• For production recurring schedules, prefer the framework-neutral taskq scheduler run. The FastAPI schedule loop is a compatibility adapter, not the default ownership model.
• Never start one scheduler loop per API replica.