Admin
Every admin-wide setting (such as the navbar title, the mount location, CSRF and authentication configurations, and the rendered theme) is passed as a keyword argument to the Admin class.
Basic usage
To get started, import the Admin class from the contrib package that matches your Object-Relational Mapper (ORM):
from starlette_admin.contrib.sqla import Admin # SQLAlchemy
from starlette_admin.contrib.sqlmodel import Admin # SQLModel
from starlette_admin.contrib.beanie import Admin # Beanie
from starlette_admin.contrib.mongoengine import Admin # MongoEngine
from starlette_admin.contrib.tortoise import Admin # Tortoise ORM
Here is a minimal configuration using SQLAlchemy:
from sqlalchemy import create_engine
from starlette.applications import Starlette
from starlette_admin.contrib.sqla import Admin, ModelView
from myapp.models import Post
engine = create_engine("sqlite:///admin.sqlite")
app = Starlette()
admin = Admin(
session_provider=engine,
title="My Admin",
base_url="/admin",
secret_key="a-long-random-string",
)
admin.add_view(ModelView(Post))
admin.mount_to(app)
- The
titleparameter sets the navbar text and the HTML<title>tag. - The
base_urldefines the path prefix where the admin is mounted. - The
secret_keysigns the CSRF and flash cookies. - The
add_viewmethod registers a view, whilemount_tobuilds the admin's routes and middleware before mounting them onto your application.
Every Admin class accepts all the configuration options documented below and occasionally adds backend-specific functionality:
contrib.sqla.Admin(session_provider, ...)requires anEngine,AsyncEngine,sessionmaker, orasync_sessionmakeras its first positional argument and automatically insertsDBSessionMiddleware. Note thatcontrib.sqlmodel.Adminis simply this same class re-exported. See SQLAlchemy and SQLModel.contrib.beanie.Admin,contrib.mongoengine.Admin, andcontrib.tortoise.Admintake no extra constructor arguments because Beanie, MongoEngine, and Tortoise ORM manage their own connections outside the admin interface. Additionally,mongoengine.Adminregisters a GridFS file-serving route withinmount_to. See Beanie, MongoEngine, and Tortoise ORM.
Full reference
All parameters listed below are accepted as keyword arguments by the Admin constructor.
Identity and branding
| Parameter | Type | Default | Description |
|---|---|---|---|
title |
str |
"Admin" |
Navbar text and <title> tag. |
logo_url |
str | Callable[[Request], str | None] | None |
None |
Logo shown in the navbar instead of title. Pass a plain URL, or a callable that resolves it per-request (e.g. per-tenant branding). |
login_logo_url |
str | Callable[[Request], str | None] | None |
None |
Logo shown on the login page instead of logo_url. Falls back to logo_url when unset. |
favicon_url |
str | Callable[[Request], str | None] | None |
None |
Favicon <link> href. |
The logo_url, login_logo_url, and favicon_url parameters accept either a string or a (request) -> str | None callable. Using a callable is particularly useful when different requests (such as different hostnames or a multi-tenant application) require dynamic branding:
def logo_for_tenant(request):
return f"https://cdn.example.com/{request.state.tenant}/logo.png"
admin = Admin(engine, title="My Admin", logo_url=logo_for_tenant)
Mounting
| Parameter | Type | Default | Description |
|---|---|---|---|
base_url |
str |
"/admin" |
URL prefix the admin is mounted under. |
route_name |
str |
"admin" |
Starlette mount name; every internal link (list, edit, exports, static assets) is generated by calling request.url_for(route_name + ":list", ...). |
Running more than one Admin within the same application requires a distinct base_url and route_name for each instance. Otherwise, generated links from one admin might incorrectly resolve to another. See Multiple Admin Instances.
Templates, statics, and theme
| Parameter | Type | Default | Description |
|---|---|---|---|
templates_dir |
str |
"templates" |
Directory checked for template overrides before falling back to the built-in templates. |
static_dir |
str | None |
None |
Directory of extra static files served alongside the built-in CSS/JS. |
theme |
BaseTheme |
DefaultTheme() |
A theme subclass defining the layout templates, icon set, and static assets. |
These options are covered in full in Custom Themes and Templates.
The home page
| Parameter | Type | Default | Description |
|---|---|---|---|
index_view |
CustomView | None |
None (a DefaultIndexView built from your registered views) |
The page rendered at base_url. |
The default is a welcome banner alongside one panel per registered model view, displaying its respective record count. To replace this, pass your own CustomView (typically a DefaultIndexView subclass or any CustomView featuring a widget). For further instructions, see Custom Views & Widgets.
Auth, security, and data safety
| Parameter | Type | Default | Description |
|---|---|---|---|
auth_provider |
BaseAuthProvider | None |
None (admin is publicly accessible) |
Gates every route. See Authentication. |
secret_key |
str | None |
None (a random key is generated at startup, with a UserWarning) |
Signs the CSRF and flash cookies. |
middlewares |
Sequence[Middleware] | None |
None |
Extra Starlette middleware, run in addition to the CSRF/flash/auth middleware the admin adds itself. |
import_config |
ImportConfig | None |
None (ImportConfig() defaults) |
Upload size and ZIP-bomb limits for the import endpoint. |
export_config |
ExportConfig | None |
None (ExportConfig() defaults) |
Row-count cap and URL-file download limits for the export endpoint. |
All five parameters are covered in depth in the Security documentation.
Locale and timezone
| Parameter | Type | Default | Description |
|---|---|---|---|
i18n_config |
I18nConfig | None |
None (English only, no LocaleMiddleware) |
Enables translated UI strings. |
timezone_config |
TimezoneConfig | None |
TimezoneConfig() (on) |
Converts displayed datetimes to the viewer's timezone. |
For a complete walkthrough, refer to Internationalization & Timezones.
Debugging
| Parameter | Type | Default | Description |
|---|---|---|---|
debug |
bool |
False |
When True, calls starlette_admin.logging.configure_logging() before startup, turning on coloured DEBUG-level console logging for the starlette_admin package. |
admin = Admin(
session_provider=engine, title="My Admin", secret_key="a-long-random-string", debug=True
)
This is highly useful during development. Every request logs the executed middleware, the view that resolved a given URL, and the reasoning behind a passed or failed permission check. Keep this disabled in production; it is verbose and adds significant logging overhead to every request.
For a lighter approach, call starlette_admin.logging.configure_logging(level=logging.INFO) manually instead of passing debug=True. This provides the handler without the complete DEBUG verbosity.
Registering Views and Mounting
After creating the Admin instance, you must register your views and mount the admin interface to your application.
admin.add_view(ModelView(Post)) # Register a view (e.g., BaseModelView, CustomView)
admin.mount_to(app) # Mount the admin onto your Starlette or FastAPI app
Registering Views
Use add_view to add components to your admin dashboard. This method accepts either a view instance or a view class. You can use it to register model views, custom pages, drop-down menus, and external links.
Mounting the Application
Once you have registered all your views, call mount_to(app) exactly once to attach the admin to your Starlette or FastAPI application. This step finalizes your routing and security configurations.
Order of operations is critical. The admin configuration is locked once mounted to ensure all views are properly routed.
- Accessing the underlying
admin.appbefore mounting raises aRuntimeError. - Attempting to register additional views or calling
mount_toagain after the initial mount also raises aRuntimeError.
admin.app # Raises RuntimeError: not mounted yet
admin.mount_to(app)
admin.app # Returns the mounted sub-application
admin.add_view(ModelView(Comment)) # Raises RuntimeError: already mounted
What's next
- Security: The
secret_key, CSRF, and complete export/import limits. - Authentication: Wiring up the
auth_provider. - Multiple Admin Instances: Running more than one
Adminin the same application.