slowapi

library0.1.10pypypi✓ verified 25d ago

SlowAPI is a Python library that provides a flexible rate-limiting extension for Starlette and FastAPI applications. It builds upon the 'limits' library to offer various storage backends (in-memory, Redis, Memcached) and granular control over rate limits per route or globally. The current version is 0.1.9, and it is actively maintained with an irregular release cadence.

http-networking web-framework devops

pip install slowapi

github ↗package ↗docs ↗

INSTALL

IMPORT

SIG · SLOWAPI

slowapi

http-networkingpythonv0.1.10

Install

2.4s avg

Import

—

Disk

19MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v0.1.10 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.910 runs

installs and imports cleanly · install 0.0s · import 0.000s · 20.6MB

glibc

py 3.10–3.910 runs

installs and imports cleanly · install 2.4s · import 0.000s · 21MB

19MB installed

● package 19MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

Limiter

✓ from slowapi import Limiter

✗ from slowapi import Limiter

This quickstart demonstrates how to integrate SlowAPI with a FastAPI application. It sets up a global `Limiter` instance using the client's IP address (`get_ipaddr`) for identification and registers an exception handler for `RateLimitExceeded` errors. Two endpoints are defined, one with a 10 requests/minute limit and another with a 2 requests/second limit, showcasing both global and route-specific rate limiting.

import uvicorn from fastapi import FastAPI, Request from slowapi import Limiter, _rate_limit_exceeded_handler from slowapi.util import get_ipaddr from slowapi.errors import RateLimitExceeded # Initialize Limiter with a key function and default limits # Using in-memory storage for simplicity, but can be 'redis://localhost:6379' etc. limiter = Limiter(key_func=get_ipaddr, default_limits=["5/minute", "100/day"]) app = FastAPI() app.state.limiter = limiter # Essential for decorator-based limits # Register the exception handler to return a 429 response app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler) @app.get("/unlimited") async def read_unlimited(): return {"message": "This endpoint is not rate limited."} @app.get("/") @limiter.limit("10/minute") # Route-specific limit async def read_root(request: Request): # The 'request' argument is required by the key_func (get_ipaddr) return {"message": "Hello, rate-limited world!"} @app.get("/fast/") @limiter.limit("2/second", "/fast/") # Another route with a custom scope async def read_fast(request: Request): return {"message": "Too fast, too furious!"} # To run this application: # 1. Save the code as 'main.py' # 2. Run from your terminal: uvicorn main:app --reload --port 8000

Debug

Known issues

gotchaMiddleware order is critical. If your application uses other middlewares (e.g., authentication, proxy headers) that modify the `Request` object (e.g., setting `request.client.host`), ensure that `slowapi`'s middleware is added *after* them. This guarantees the `key_func` receives the final, correct request state for identification.

fix

Place `app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)` and ensure `app.state.limiter` is set *before* other middlewares if using the middleware approach, or be mindful of the order in `app.add_middleware()`.

affects: 0.1.0+

gotchaThe `key_func` (e.g., `get_ipaddr`) is essential for identifying unique requests for rate limiting. Misconfiguring or omitting it will lead to all requests sharing the same limit or ineffective rate limiting. Custom `key_func`s must correctly extract a unique identifier from the `Request` object.

fix

Always provide a `key_func` during `Limiter` initialization. For custom identification (e.g., by user ID), define a function that extracts the ID from the `Request` object (e.g., `request.state.user.id`).

affects: 0.1.0+

gotchaTo return a custom HTTP 429 (Too Many Requests) response when a rate limit is exceeded, you must explicitly register the `_rate_limit_exceeded_handler` (or a custom handler) with your application's exception handlers. Failing to do so will result in a generic server error (e.g., HTTP 500) instead of the expected 429.

fix

Add `app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)` to your FastAPI/Starlette application setup.

affects: 0.1.0+

gotchaThe rate-limiting storage backend is determined by the `LIMITS_STORAGE_URI` environment variable or the `storage_uri` parameter in `Limiter`. Not setting it or setting it incorrectly (e.g., forgetting `memory://` for in-memory or incorrect Redis/Memcached URIs) will lead to runtime errors or incorrect rate limiting behavior.

fix

Ensure `storage_uri` is correctly set, e.g., `memory://` for testing, `redis://localhost:6379` for Redis, or `memcached://localhost:11211` for Memcached. Install the necessary optional dependencies (e.g., `slowapi[redis]`) for non-memory backends.

affects: 0.1.0+

Upgrade

Version history

0.1.10latest on PyPI · released Jun 13, 2026

Audit

Dependencies

starletterequiredCore web framework dependency for ASGI applications.

limitsrequiredCore rate-limiting logic provider, SlowAPI is an extension for ASGI.

fastapioptionalOptional: For FastAPI application integration and its dependency injection system.

redisoptionalOptional: Required for using Redis as a rate-limiting storage backend.

python-memcachedoptionalOptional: Required for using Memcached as a rate-limiting storage backend.

Agent activity

26 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/laurents/slowapi ↗

packagehttps://pypi.org/project/slowapi/ ↗

docshttps://slowapi.readthedocs.io/en/latest/ ↗