HTTP facade

Some fleets must not hold database credentials. Mount the optional FastAPI sub-app in your API process:

from fastapi import FastAPI
from taskq.http import (
    ClaimWaitHub,
    TaskqFacadeTransports,
    create_taskq_app,
    static_api_key_auth,
)

taskq_app = create_taskq_app(
    TaskqFacadeTransports(
        producer=producer_transport,
        runner=runner_transport,
        observer=observer_transport,
        authorization=authorization_transport,
        claim_wait_hub=ClaimWaitHub(),
    ),
    authorizer=static_api_key_auth("secret"),
    # optional: operator_transport=…, operator_authorizer=… together
)

host = FastAPI()
host.mount("/taskq", taskq_app)
# Wire paths live under /taskq/v1/...

Requires outlabs-taskq[http].

Auth is injected

A QueueAuthorizer is required. Built-ins in taskq.http:

• static_api_key_auth
• bearer_token_auth
• callable_auth
• legacy_taskq_auth
• no_auth_for_tests (tests only)

OutLabs IAM: OutlabsQueueAuthorizer from taskq.http.outlabs ([outlabs] extra). See Authorization.

Topology rules

• HTTP workers point taskq worker at --http-base-url with bearer or custom header credentials.
• HTTP workers must not use LISTEN.
• Housekeeping / claim-wait / optional embedded worker belong on the facade host via TaskqRuntime / taskq_lifespan — not inside each worker process.