httpx

HTTPX has become my go-to replacement for requests in production systems. The library enforces TLS 1.2+ by default and uses secure cipher suites out of the box—no configuration tweaking needed. Certificate verification is mandatory unless explicitly disabled, which aligns with secure-by-default principles. The connection pooling and timeout handling are production-ready with sensible defaults that prevent hanging connections.

The async/await support is first-class, not bolted on. I've used it extensively in FastAPI services where maintaining connection pools across async requests is critical. Error handling is well-designed: network errors, timeouts, and HTTP errors have distinct exception types that don't leak sensitive data in tracebacks. The Client() context manager pattern encourages proper resource cleanup.

From a supply chain perspective, the dependency footprint is minimal—primarily httpcore, certifi, and idna. The maintainers are responsive to CVEs, particularly around certificate validation. Input validation for URLs and headers is strict, rejecting malformed data early rather than passing it through. Authentication helpers (basic, digest, bearer) are straightforward and handle credential encoding safely.

Coming from requests, httpx feels immediately familiar while adding powerful async capabilities. The API is nearly identical for synchronous usage (httpx.get, httpx.post), making the transition painless. Where it really shines is the async client - proper connection pooling with httpx.AsyncClient() just works, and you can easily switch between sync and async without learning different interfaces.

The documentation is genuinely excellent with practical examples covering everything from basic requests to advanced topics like custom authentication and event hooks. Error messages are clear and actionable - when I misconfigured timeouts or connection limits, the exceptions told me exactly what went wrong. The QuickStart guide gets you productive in minutes, and the Advanced Usage section covers real-world scenarios like retries and streaming.

Debugging is straightforward with built-in event hooks for logging requests/responses. The library handles edge cases well - proper handling of redirects, cookies, and HTTP/2 without manual configuration. Stack Overflow coverage is decent, and GitHub issues get timely responses from maintainers who actually help solve problems.

HTTPX feels like a natural evolution of requests, maintaining the familiar API while adding async/await support and HTTP/2. The type hints are exceptional - IDE autocomplete works flawlessly, and mypy catches issues at development time. The ability to use the same Client interface for both sync and async code makes it trivial to migrate existing requests code incrementally.

The documentation is comprehensive with practical examples for common patterns like connection pooling, timeouts, and retries. Error messages are clear and actionable - when you misconfigure something like authentication or headers, the traceback points you exactly where to look. The unified exception hierarchy (HTTPError, TimeoutException, etc.) makes error handling predictable.

Day-to-day usage is smooth. The context manager pattern for clients encourages proper resource cleanup, and the transport layer is customizable when you need it. One minor friction point is understanding when to use Client vs AsyncClient and managing their lifecycles in larger applications, but the docs cover this well.