fastapi-limiter

What it is and what it does

fastapi-limiter wraps pyrate-limiter to provide a FastAPI dependency that enforces request rate limits on individual routes. It identifies requests by IP and path by default, but supports custom identifiers like user ID. When a limit is exceeded, it raises an HTTP 429 response by default, though you can provide a custom callback. The package works with both REST endpoints and WebSocket connections, and allows stacking multiple limiters on a single route with different thresholds.

The package integrates directly into FastAPI's dependency injection system, so rate limiting is declared as a route parameter rather than middleware. It supports Python 3.9 through 3.14 and has no known security vulnerabilities. The aging maintenance status reflects infrequent releases, but the repository remains public and the dependency surface is minimal.

Use it for:

• Protect public API endpoints from abuse by limiting requests per IP to a fixed number per time window.
• Implement tiered rate limits on a single route (e.g., 1 request per 5 seconds, then 2 per 15 seconds).
• Rate-limit WebSocket connections by checking limits on each incoming message.
• Skip rate limiting on specific routes using the skip_limiter decorator for whitelisted endpoints.
• Customize rate limit identification by user ID, API key, or other request attributes instead of IP.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Adds request rate limiting to FastAPI routes using configurable per-second or per-interval limits, with support for custom request identifiers and callback handlers.

Yes, if you need straightforward per-route rate limiting in FastAPI. The low install friction, permissive license, and zero known vulnerabilities make it a safe choice. The aging maintenance status (189 days since last release) is a minor concern but not a blocker—the package is stable and the dependency chain is minimal. Install it if your use case fits the built-in features; consider alternatives if you need distributed rate limiting across multiple instances.

Install

fastapi-limiter on PyPI

pip install fastapi-limiter

uv add fastapi-limiter

poetry add fastapi-limiter

Installing fastapi-limiter

Before you install

Low friction install with only two runtime dependencies (fastapi and pyrate-limiter). Maintenance status is aging—last release 189 days ago, though the repository remains active with 790 stars and no archived flag.

License in practice

Licensed under Apache-2.0 (permissive), allowing commercial and private use with minimal restrictions.

Quickstart

pip install fastapi-limiter

from fastapi import Depends, FastAPI
from pyrate_limiter import Duration, Limiter, Rate
from fastapi_limiter.depends import RateLimiter

app = FastAPI()

@app.get("/", dependencies=[Depends(RateLimiter(limiter=Limiter(Rate(2, Duration.SECOND * 5))))])
async def index():
    return {"msg": "Hello World"}

Verify before relying

• Whether the package supports distributed rate limiting across multiple application instances or only in-process limits.
• Performance characteristics under high request volumes or with many concurrent limiters.

Package facts

Evidence: fastapi_limiter-0.2.0-py3-none-any.whl

Keywords: fastapi, limiter

Tags

More WWW/HTTP packages