slowapi
A rate limiting extension for Starlette and Fastapi
Decision gist · record as of 2026-08-14
Yes. SlowApi is actively maintained, has low install friction, carries no known vulnerabilities, and uses a permissive MIT license. It solves a concrete problem (rate limiting) with a straightforward API. Install it if you need per-endpoint request quotas; skip it only if you handle rate limiting at the infrastructure or reverse-proxy layer instead.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- The request argument must be explicitly passed to your endpoint function; websocket endpoints are not supported.
- Low install friction with a single runtime dependency (limits).
- Actively maintained with a recent release 62 days ago and 2045 repository stars.
License · maintenance · safety
MIT (permissive) — MIT license permits commercial and private use with minimal restrictions, making it suitable for most production deployments.
last release 2026-06-13 (62 days) · last repo commit 2026-08-04 · 2,045 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 21,589,624 downloads/mo, #995 on PyPI
Alternatives
Verify before relying
pip install slowapi
from slowapi import Limiter
from slowapi.util import get_remote_address
limiter = Limiter(key_func=get_remote_address)
@limiter.limit("5/minute")
async def myendpoint(request):
pass- Whether the library's async support is fully complete or if further API changes are planned beyond current semver notifications.
- Specific performance characteristics when handling the scale mentioned (millions of requests per month).
- How slowapi integrates with specific web frameworks beyond the decorator pattern shown in documentation.
What it is and what it does
SlowApi is a rate-limiting wrapper adapted from flask-limiter that applies per-endpoint request quotas using simple decorator syntax. It delegates the actual rate-limiting logic to the limits library and provides backends for redis, memcached, and in-memory storage to track request counts. You decorate your endpoint functions with @limiter.limit("N/period") to enforce quotas; the library supports both sync and async endpoints and can share limits across multiple routes.
The package is used in production handling millions of requests monthly. Its primary constraint is that the request object must be explicitly included in your endpoint signature for the decorator to intercept it; websocket endpoints are not yet supported. It aims to track all currently supported Python versions and notifies users of breaking changes via semantic versioning.
Use it for
- Prevent abuse by limiting API calls to 5 requests per minute per user IP address.
- Enforce tiered rate limits across multiple endpoints using shared limit keys.
- Use redis as a distributed backend to enforce consistent rate limits across multiple application instances.
- Protect internal services from accidental overload by applying request quotas to specific routes.
- Combine with memcached for rate limiting in containerized deployments without external dependencies.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
SlowApi is actively maintained, has low install friction, carries no known vulnerabilities, and uses a permissive MIT license. It solves a concrete problem (rate limiting) with a straightforward API. Install it if you need per-endpoint request quotas; skip it only if you handle rate limiting at the infrastructure or reverse-proxy layer instead.
Install
slowapi on PyPI
Before you install
Low install friction with a single runtime dependency (limits). Actively maintained with a recent release 62 days ago and 2045 repository stars. Supports current Python versions from 3.7 through 3.13.
The request argument must be explicitly passed to your endpoint function; websocket endpoints are not supported.
License in practice
MIT license permits commercial and private use with minimal restrictions, making it suitable for most production deployments.
Quickstart
pip install slowapi
from slowapi import Limiter
from slowapi.util import get_remote_address
limiter = Limiter(key_func=get_remote_address)
@limiter.limit("5/minute")
async def myendpoint(request):
passVerify before relying
- Whether the library's async support is fully complete or if further API changes are planned beyond current semver notifications.
- Specific performance characteristics when handling the scale mentioned (millions of requests per month).
- How slowapi integrates with specific web frameworks beyond the decorator pattern shown in documentation.
Package facts
| License | MIT permissive |
| Python support | Supports the current Python release <4.0,>=3.7 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 1 packagelimits |
| Maintenance | Actively maintained 62 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 21,589,624 / month, #995 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | License :: OSI Approved :: MIT LicenseProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.7Programming Language :: Python :: 3.8Programming Language :: Python :: 3.9 |
Evidence: slowapi-0.1.10-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “starlette rate limiter”
- slowapiAdds rate limiting to Starlette and FastAPI endpoints using…
- httpx-limiterProvides rate-limited HTTP transports for httpx clients, supporting…
- asynciolimiterProvides rate limiting for async Python code by enforcing a maximum…
Give your agent the search over MCP, or paste the wish link into any chat.
More Dynamic Content packages
MarkupSafe provides a text object that escapes special characters so untrusted strings can be safely embedded in HTML and XML without injection attacks.
Jinja2 is a templating engine that renders dynamic content by combining templates with Python-like syntax and data, supporting template inheritance, macros, autoescaping, and sandboxed execution.
Soupsieve is a CSS selector library designed to work with Beautiful Soup 4 to select, match, and filter HTML and XML elements using modern CSS selectors from CSS level 1 through CSS level 4 specifications.
Install it if you use Beautiful Soup for HTML or XML parsing and want modern CSS selector support.
Werkzeug is a WSGI utility library providing request/response objects, URL routing, an interactive debugger, HTTP utilities, and a development server for building web applications.
Flask is a lightweight WSGI web application framework for building web applications in Python, from simple single-page sites to complex multi-route applications.
Mako compiles Python-embedded templates into Python modules for fast rendering, supporting layout inheritance, custom functions, and direct Python expressions within template syntax.
See also Flask-Limiter · fastapi-limiter · limits · asgi-ratelimit · throttled-py · requests-ratelimiter · ratelimit · piccolo-api · fastapi-decorators · starlette-admin