Hey, Flutter fam! Episode 4 of our Flutter x Serverpod series is here! Last time we integrated authentication: login, registration, reset/forgot password, validation code, and secure Home screen. If you’re signed in and staring at an empty task list right now… perfect. Today, we’re filling it with secure CRUD operations for our fintech to-do app.
We’re creating, reading, updating, and deleting trade alerts that are fully owned by the logged-in user, with validation to prevent anyone from entering a negative amount. By the end, your app will feel production-ready, complete with empty states, loading spinners, error toasts, and more. Let’s build! Subscribe and let’s code! 🚀
<a href="https://youtu.be/EcG0xyO5dwE" target="_blank" rel="noopener nofollow">#4 - Task: CRUD Operations on YouTube.</a>
<h3>FOR BETTER UNDERSTANDING, REFER TO THE <a href="https://youtu.be/EcG0xyO5dwE" target="_blank" rel="noopener nofollow">YOUTUBE VIDEO</a>.</h3>
First, our Task model
In <code>fintech_todo_server/lib/src/task.spy.yaml</code>:
<pre><code class="language-Yaml">class: Task

table: task

fields:
 id: int?
 title: String
 description: String
 amount: double
 dueDate: DateTime?
 userId: int
</code></pre>
<h3>Create migration:</h3>
<pre><code class="language-Bash">cd fintech_todo_server
serverpod create-migration
</code></pre>
<h3>Apply</h3>
<pre><code class="language-Bash">dart run bin/main.dart --role maintenance --apply-migrations
</code></pre>
Done - Postgres now has a task table linked to the auth user table.
<h3>Building the Secure TaskEndpoint</h3>
File: <code>fintech_todo_server/lib/src/task_endpoint.dart</code>
<pre><code class="language-Dart">import &#x27;package:fintech_todo_server/src/exceptions.dart&#x27;;
import &#x27;package:fintech_todo_server/src/generated/protocol.dart&#x27;;
import &#x27;package:serverpod/serverpod.dart&#x27;;

class TaskEndpoint extends Endpoint {
 @override
 bool get requireLogin =&gt; true;

 // CREATE
 Future&lt;Task&gt; createTask(Session session, Task request) async {
 final auth = await session.authenticated;

 if (auth == null) {
 throw AuthorizationException(message: &quot;You&#x27;re not authenticated!&quot;);
 }
 final userId = auth.userId;

 // Validation
 if (request.title.isEmpty) {
 throw ValidationException(message: &quot;Title cannot be empty&quot;);
 }

 if (request.amount &lt;= 0) {
 throw ValidationException(message: &quot;Amount must be greater than zero&quot;);
 }

 final task = Task(
 userId: userId,
 title: request.title,
 amount: request.amount,
 description: request.description,
 dueDate: request.dueDate,
 );

 final inserted = await Task.db.insertRow(session, task);
 return inserted;
 }

 // READ
 Future&lt;List&lt;Task&gt;&gt; getTasks(Session session) async {
 final auth = await session.authenticated;

 if (auth == null) {
 throw AuthorizationException(message: &quot;You&#x27;re not authenticated!&quot;);
 }
 final userId = auth.userId;

 final tasks = await Task.db.find(
 session,
 where: (t) =&gt; t.userId.equals(userId),
 orderBy: (t) =&gt; t.dueDate,
 orderDescending: true,
 );
 return tasks;
 }

 // UPDATE
 Future&lt;Task&gt; updateTask(Session session, Task request) async {
 final auth = await session.authenticated;

 if (auth == null) {
 throw AuthorizationException(message: &quot;You&#x27;re not authenticated!&quot;);
 }
 final userId = auth.userId;

 if (request.id == null) {
 throw ValidationException(message: &quot;Task ID is required for update&quot;);
 }

 if (request.title.isEmpty) {
 throw ValidationException(message: &quot;Title cannot be empty&quot;);
 }

 if (request.amount &lt;= 0) {
 throw ValidationException(message: &quot;Amount must be greater than zero&quot;);
 }

 final existingTask = await Task.db.findById(session, request.id!);

 if (existingTask == null) {
 throw NotFoundException(message: &quot;Task with ID ${request.id} not found.&quot;);
 }
 if (existingTask.userId != userId) {
 throw AuthorizationException(
 message: &quot;You do not have permission to update this task.&quot;);
 }

 final updatedTask = existingTask.copyWith(
 title: request.title,
 amount: request.amount,
 description: request.description,
 dueDate: request.dueDate,
 );

 final result = await Task.db.updateRow(session, updatedTask);
 return result;
 }

 // DELETE
 Future&lt;void&gt; deleteTask(Session session, int taskId) async {
 final auth = await session.authenticated;

 if (auth == null) {
 throw AuthorizationException(message: &quot;You&#x27;re not authenticated!&quot;);
 }
 final userId = auth.userId;

 final rowsDeleted = await Task.db.deleteWhere(
 session,
 where: (t) =&gt; t.id.equals(taskId) &amp; t.userId.equals(userId),
 );

 if (rowsDeleted.isEmpty) {
 throw NotFoundException(message: &quot;Task with ID $taskId not found.&quot;);
 }
 }
}
</code></pre>
<h3>Regenerate client:</h3>
<pre><code class="language-Bash">serverpod generate
</code></pre>
<h3>Flutter Side: Beautiful Task List + Forms</h3>
Switch to <code>fintech_todo_flutter</code>
Key screens we built live:
TaskListScreen - Empty state + ListView.builder
TaskFormDialog - Create/Edit modal
Delete confirmation
Code highlights (copy-paste ready in description):
<pre><code class="language-Dart">// In HomeScreen
Future&lt;void&gt; _loadTasks() async {
 try {
 final tasks = await client.task.getTasks();
 setState(() =&gt; taskList = tasks);
 } catch (e) {
 ScaffoldMessenger.of(context).showSnackBar(SnackBar(content: Text(&#x27;Load failed: $e&#x27;)));
 }
}
</code></pre>
// FAB → showDialog(TaskFormDialog())
Real demo flow:
Login → Empty state (“No trades yet - add one!”)
Tap FAB → Fill form → Save → Task appears instantly
Edit → Update → List refreshes
Delete → Confirmation → Gone
That’s it - you now have a fully secure, user-owned task system! No more public todos - every task belongs to the signed-in trader.
I hope you have learn something incredible. Press that follow button if you’re not following me yet. Also, make sure to subscribe to the newsletter so you’re notified when I publish a new article. Kindly press the clap button as many times as you want if you enjoy it, and feel free to ask a question.
Source Code 👇 - Show some ❤️ by starring ⭐ the repo and follow me 😄!
<a href="https://github.com/techwithsam/fintech_todo_serverpod" target="_blank" rel="noopener nofollow">github techwithsam/fintech_todo_serverpod</a>
Drop a like if this helped, comment your experience with Serverpod and this series, and join Discord for the updated repo + bonus snippets: <a href="https://discord.gg/NytgTkyw3R" target="_blank" rel="noopener nofollow">https://discord.gg/NytgTkyw3R</a>
Samuel Adekunle, Tech With Sam <a href="https://youtube.com/@techwithsam" target="_blank" rel="noopener nofollow">YouTube</a> | Part 5Teaser
Happy Building! 🥰👨‍💻

Samuel Adekunle

This tutorial demonstrates implementing secure CRUD operations in a Flutter mobile app using Serverpod as the backend. It covers creating a Task model with database migrations, building a secure endpoint with user authentication and validation, and developing Flutter UI components including task lists, forms, and delete confirmations. Each task is owned by the authenticated user with validation preventing negative amounts, featuring empty states, loading indicators, and error handling for a production-ready experience.

Full-Stack Mobile Development (Flutter + Serverpod) #4 - Task CRUD Operations