fastify-best-practices

Use @fastify/jwt to sign and verify tokens, then decorate the instance with an authenticate function that calls request.jwtVerify(). Protect routes by adding that decorator to the onRequest hook, and implement refresh token rotation for longer sessions.

Define a JSON Schema on the route's schema.body property and Fastify validates the payload automatically before the handler runs. The same schema approach works for params, querystring, headers, and response serialization.

Yes, Fastify works with TypeScript via strip types and declaration merging. You extend the FastifyInstance, FastifyRequest, and FastifyReply interfaces through declare module to get type safety on decorators and custom properties.

Register routes and services as plugins using app.register, which provides automatic encapsulation of decorators and hooks. Use fastify-plugin (fp) when a decorator or connection must be shared across sibling plugins, and declare plugin dependencies explicitly.

In-memory rate limiting only tracks requests per process, so limits are bypassed when running multiple instances behind a load balancer. Configure @fastify/rate-limit with a Redis backend so counters are shared across all instances.

Use close-with-grace for graceful shutdown, expose /health/live and /health/ready endpoints for orchestrator probes, and configure trustProxy when behind a load balancer. The deployment rules include Dockerfile, Kubernetes manifest, and Prometheus metrics examples.