---
id: asgi-ratelimit
version: "0.10.0"
license: Apache-2.0
license_treatment: permissive
maintenance: dormant
---

# asgi-ratelimit

License: permissive · Maintenance: dormant · Downloads: 127.5K/mo

## What it is and what it does

asgi-ratelimit is an ASGI middleware that sits between your web application and incoming requests, enforcing rate limits based on user identity and group membership. It lets you define rules that restrict how often a user can hit specific endpoints—for example, allowing 1 request per second to one endpoint and 1 per minute to another—with different limits for different user groups like admins. The middleware can use an in-memory backend for simple cases or Redis for distributed setups.

You configure it with regex patterns matching your routes and Rule objects specifying time windows (second, minute, day) and optional group names. When a user exceeds the limit, the middleware returns HTTP 429 and blocks further requests for a configurable period. It requires you to provide an authentication function that extracts the user ID and group from the ASGI scope—the package includes built-in helpers for IP-based, session-based, and JWT-based identification.

Use it for:

- Protect API endpoints from abuse by limiting requests per user to a fixed rate per second or minute.
- Implement tiered access where admin users get higher rate limits than regular users on the same endpoint.
- Share rate-limit budgets across multiple related endpoints using the zone parameter.
- Customize 429 responses with your own handler to return application-specific error messages.
- Use Redis backend to enforce consistent rate limits across multiple application instances.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

An ASGI middleware that enforces rate limits on HTTP requests by user or group, with support for multiple time windows, regex-based routing, and pluggable backends like memory or Redis.

Yes, with conditions. Install if you need straightforward per-user rate limiting on an ASGI app and can accept that the package is no longer actively maintained (last release 2022-12-07). The low install friction, permissive license, and zero known vulnerabilities make it safe to add. However, verify compatibility with your specific ASGI framework version and Python release, and plan for potential maintenance burden if you need to patch it yourself.

## Install

pip install asgi-ratelimit
uv add asgi-ratelimit
poetry add asgi-ratelimit

## Installing asgi-ratelimit

Before you install: Low install friction; pure Python wheel with only dataclasses as a runtime dependency. Maintenance is dormant—last release was 2022-12-07, though the repository remains active. Suitable for projects that can tolerate no further updates.

License in practice: Apache-2.0 permissive license allows commercial use, modification, and distribution with minimal restrictions, making it safe for most projects.

Quickstart:

pip install asgi-ratelimit

from ratelimit import RateLimitMiddleware, Rule
from ratelimit.backends.simple import MemoryBackend

rate_limit = RateLimitMiddleware(
    app,
    auth_function,
    MemoryBackend(),
    {r"^/endpoint": [Rule(second=1, group="default")]}
)

Requires an ASGI application and an async authentication function that returns (user_id, group_name) tuple from the ASGI scope.

Verify before relying:

- Whether dormant maintenance status poses compatibility risks with modern ASGI frameworks or Python versions.
- Performance characteristics under high concurrency or with large numbers of concurrent users.
- Whether Redis backend requires additional setup or configuration beyond the redis.asyncio dependency.

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: dormant
- Downloads: 127.5K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

rate limiting middleware asgi, request frequency throttling, per-user rate limits http, asgi middleware 429 responses, redis-backed rate limiting, group-based access control limits, regex route rate limiting, asgi-middleware, rate-limiting, access-control

[View on SkillFed](https://skillfed.io/packages/asgi-ratelimit) · [View on PyPI](https://pypi.org/project/asgi-ratelimit/)