Rate limiting controls how many requests a client can make within a specific period of time.

For example, an IP address may be allowed to attempt login only five times per minute.

1. What Is SlowAPI?

SlowAPI is a rate-limiting library for FastAPI and Starlette, adapted from Flask-Limiter. It uses the limits library to manage counters and enforce request limits.

2. How Does Rate Limiting Work?

For every request, the rate limiter performs three steps:

1. Identify the client: Usually by IP address or user ID.
2. Count the request: Update the corresponding counter.
3. Check the limit: Allow the request to continue or return HTTP 429.

For example, with a limit of 5/minute, the sixth request within the same limiting window will be rejected.

Counters are stored in a storage backend:

• memory:// stores counters inside the Python process.
• redis:// stores counters in Redis, allowing multiple workers or servers to share them.

3. Install SlowAPI

Install the required libraries:

pip install slowapi redis

SlowAPI uses the limits library internally to manage rate limits.

a. Initialize the Rate Limiter

Create a shared limiter for your FastAPI application:

from fastapi import FastAPI
from slowapi import Limiter, _rate_limit_exceeded_handler
from slowapi.errors import RateLimitExceeded
from slowapi.util import get_remote_address

app = FastAPI()

limiter = Limiter(
    key_func=get_remote_address,
    storage_uri="memory://",
    headers_enabled=True,
)

app.state.limiter = limiter

app.add_exception_handler(
    RateLimitExceeded,
    _rate_limit_exceeded_handler,
)

Here’s what each option does:

• key_func: Identifies the client. This example uses the client’s IP address.
• storage_uri: Specifies where request counters are stored.
• headers_enabled=True: Enables rate-limit response headers.
• app.state.limiter: Registers the limiter with the FastAPI application.
• add_exception_handler: Handles requests that exceed their limits.

In this example, memory:// is a simple choice for local development and experimentation.

b. Limit an Individual Endpoint

Use the @limiter.limit() decorator to restrict requests to a specific endpoint:

from fastapi import Request, Response

@app.post("/login")
@limiter.limit("5/minute")
async def login(
    request: Request,
    response: Response,
):
    return {"message": "Login endpoint"}

This endpoint allows five requests per minute per client IP.

SlowAPI requires the request: Request parameter to identify the client. If your endpoint returns a dictionary or Pydantic model rather than an existing Response object, add response: Response so the library can attach rate-limit headers.

Common limit formats include:

c. Set a Global Rate Limit

Besides individual endpoint limits, you can configure a default limit for the application.

For example, allow each IP address up to 200 requests per minute:

from slowapi.middleware import SlowAPIASGIMiddleware

limiter = Limiter(
    key_func=get_remote_address,
    application_limits=["200/minute"],
)

app.state.limiter = limiter
app.add_middleware(SlowAPIASGIMiddleware)

You can exclude endpoints such as health checks:

@app.get("/health")
@limiter.exempt
async def health():
    return {"status": "ok"}