It sounds like you are probably fine. Your python flask script is the API layer. Just make sure it can only run sql that you want it to run (ideally, read only until you get it authenticated), and that it escapes user input, and that no one except admins have access to the actual db underneath, and you are totally fine.

Also, for that matter, its a good idea to run backups too, just in case something goes wrong and you need to restore.

This is literally people allowing users to run arbitrary commands on their fully exposed db, and then being surprised when someone runs a delete.