asgi-ratelimit
Decision gist · record as of 2026-08-14
Yes, with conditions. Install if you need straightforward per-user rate limiting on an ASGI app and can accept that the package is no longer actively maintained (last release 2022-12-07). The low install friction, permissive license, and zero known vulnerabilities make it safe to add. However, verify compatibility with your specific ASGI framework version and Python release, and plan for potential maintenance burden if you need to patch it yourself.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires an ASGI application and an async authentication function that returns (user_id, group_name) tuple from the ASGI scope.
- Low install friction; pure Python wheel with only dataclasses as a runtime dependency.
- Maintenance is dormant—last release was 2022-12-07, though the repository remains active.
License · maintenance · safety
Apache-2.0 (permissive) — Apache-2.0 permissive license allows commercial use, modification, and distribution with minimal restrictions, making it safe for most projects.
last release 2022-12-07 (1346 days) · last repo commit 2024-08-03 · 344 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 127,463 downloads/mo, #11,741 on PyPI
Alternatives
Verify before relying
pip install asgi-ratelimit
from ratelimit import RateLimitMiddleware, Rule
from ratelimit.backends.simple import MemoryBackend
rate_limit = RateLimitMiddleware(
app,
auth_function,
MemoryBackend(),
{r"^/endpoint": [Rule(second=1, group="default")]}
)- Whether dormant maintenance status poses compatibility risks with modern ASGI frameworks or Python versions.
- Performance characteristics under high concurrency or with large numbers of concurrent users.
- Whether Redis backend requires additional setup or configuration beyond the redis.asyncio dependency.
What it is and what it does
asgi-ratelimit is an ASGI middleware that sits between your web application and incoming requests, enforcing rate limits based on user identity and group membership. It lets you define rules that restrict how often a user can hit specific endpoints—for example, allowing 1 request per second to one endpoint and 1 per minute to another—with different limits for different user groups like admins. The middleware can use an in-memory backend for simple cases or Redis for distributed setups.
You configure it with regex patterns matching your routes and Rule objects specifying time windows (second, minute, day) and optional group names. When a user exceeds the limit, the middleware returns HTTP 429 and blocks further requests for a configurable period. It requires you to provide an authentication function that extracts the user ID and group from the ASGI scope—the package includes built-in helpers for IP-based, session-based, and JWT-based identification.
Use it for
- Protect API endpoints from abuse by limiting requests per user to a fixed rate per second or minute.
- Implement tiered access where admin users get higher rate limits than regular users on the same endpoint.
- Share rate-limit budgets across multiple related endpoints using the zone parameter.
- Customize 429 responses with your own handler to return application-specific error messages.
- Use Redis backend to enforce consistent rate limits across multiple application instances.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, with conditions.
Install if you need straightforward per-user rate limiting on an ASGI app and can accept that the package is no longer actively maintained (last release 2022-12-07). The low install friction, permissive license, and zero known vulnerabilities make it safe to add. However, verify compatibility with your specific ASGI framework version and Python release, and plan for potential maintenance burden if you need to patch it yourself.
Install
asgi-ratelimit on PyPI
Before you install
Low install friction; pure Python wheel with only dataclasses as a runtime dependency. Maintenance is dormant—last release was 2022-12-07, though the repository remains active. Suitable for projects that can tolerate no further updates.
Requires an ASGI application and an async authentication function that returns (user_id, group_name) tuple from the ASGI scope.
License in practice
Apache-2.0 permissive license allows commercial use, modification, and distribution with minimal restrictions, making it safe for most projects.
Quickstart
pip install asgi-ratelimit
from ratelimit import RateLimitMiddleware, Rule
from ratelimit.backends.simple import MemoryBackend
rate_limit = RateLimitMiddleware(
app,
auth_function,
MemoryBackend(),
{r"^/endpoint": [Rule(second=1, group="default")]}
)Verify before relying
- Whether dormant maintenance status poses compatibility risks with modern ASGI frameworks or Python versions.
- Performance characteristics under high concurrency or with large numbers of concurrent users.
- Whether Redis backend requires additional setup or configuration beyond the redis.asyncio dependency.
Package facts
| License | Apache-2.0 permissive |
| Python support | Supports the current Python release >=3.6,<4.0 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 1 packagedataclasses |
| Maintenance | Dormant 1,346 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 127,463 / month, #11,741 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | License :: OSI Approved :: Apache Software LicenseProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.6Programming Language :: Python :: 3.7Programming Language :: Python :: 3.8Programming Language :: Python :: 3.9 |
Evidence: asgi_ratelimit-0.10.0-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “rate limiting middleware asgi”
- asgi-ratelimitAn ASGI middleware that enforces rate limits on HTTP requests by user…
- piccolo-apiExposes Piccolo ORM tables as REST endpoints in ASGI applications and…
- token-throttlerToken throttler implements rate limiting using a token bucket…
Give your agent the search over MCP, or paste the wish link into any chat.
More WWW/HTTP packages
urllib3 is an HTTP client library that provides thread-safe connection pooling, SSL/TLS verification, multipart file uploads, request retries, compression support, and proxy handling for Python applications.
Requests is a Python HTTP library that simplifies sending HTTP/1.1 requests with automatic handling of headers, authentication, cookies, and response parsing.
h11 is a pure-Python HTTP/1.1 protocol implementation that handles parsing and serializing HTTP messages without any built-in I/O, letting you integrate it with any network layer you choose.
HTTPX is a fully featured HTTP client library for Python that provides both sync and async APIs, with support for HTTP/1.1 and HTTP/2, plus an integrated command-line client.
Install it if you are building new projects or modernizing existing ones that rely on HTTP.
A minimal low-level HTTP client library that sends HTTP requests with thread-safe and task-safe connection pooling, supporting HTTP/1.1, HTTP/2, proxies, and both sync and async interfaces.
aiohttp is an async HTTP client and server framework built on asyncio, supporting both WebSockets and middleware-based routing for building concurrent web applications.
Install it if you need async HTTP client or server capabilities in asyncio-based applications.
See also python-redis-rate-limit · slowapi · fastapi-limiter · Flask-Limiter · requests-ratelimiter · asynciolimiter · ratelimit · django-ratelimit · piccolo-api · asyncio-throttle