Flask-Limiter adds rate limiting to Flask applications.
You can configure rate limits at different levels such as:
Application wide global limits per user
Default limits per route
By Blueprints
Flask-Limiter can be configured to fit your application in many ways, including:
Persistance to various commonly used storage backends (such as Redis, Memcached & MongoDB) via limits
Any rate limiting strategy supported by limits
Follow the quickstart below to get started or read the documentation for more details.
Quickstart
Install
pip install Flask-LimiterAdd the rate limiter to your flask app
# app.py
from flask import Flask
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address
app = Flask(__name__)
limiter = Limiter(
get_remote_address,
app=app,
default_limits=["2 per minute", "1 per second"],
storage_uri="memory://",
# Redis
# storage_uri="redis://localhost:6379",
# Redis cluster
# storage_uri="redis+cluster://localhost:7000,localhost:7001,localhost:70002",
# Memcached
# storage_uri="memcached://localhost:11211",
# Memcached Cluster
# storage_uri="memcached://localhost:11211,localhost:11212,localhost:11213",
# MongoDB
# storage_uri="mongodb://localhost:27017",
strategy="fixed-window", # or "moving-window", or "sliding-window-counter"
)
@app.route("/slow")
@limiter.limit("1 per day")
def slow():
return "24"
@app.route("/fast")
def fast():
return "42"
@app.route("/ping")
@limiter.exempt
def ping():
return 'PONG'Inspect the limits using the command line interface
$ FLASK_APP=app:app flask limiter limits
app
├── fast: /fast
│ ├── 2 per 1 minute
│ └── 1 per 1 second
├── ping: /ping
│ └── Exempt
└── slow: /slow
└── 1 per 1 dayRun the app
$ FLASK_APP=app:app flask runTest it out
The fast endpoint respects the default rate limit while the slow endpoint uses the decorated one. ping has no rate limit associated with it.
$ curl localhost:5000/fast
42
$ curl localhost:5000/fast
42
$ curl localhost:5000/fast
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<title>429 Too Many Requests</title>
<h1>Too Many Requests</h1>
<p>2 per 1 minute</p>
$ curl localhost:5000/slow
24
$ curl localhost:5000/slow
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<title>429 Too Many Requests</title>
<h1>Too Many Requests</h1>
<p>1 per 1 day</p>
$ curl localhost:5000/ping
PONG
$ curl localhost:5000/ping
PONG
$ curl localhost:5000/ping
PONG
$ curl localhost:5000/ping
PONG1 maintainer
Metadata
1 maintainer
Release files for Flask-Limiter 4.0.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| flask_limiter-4.0.0.tar.gz | 384.4 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| flask_limiter-4.0.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 414.3 kB
Release files / flask_limiter-4.0.0.tar.gz
| Download URL | flask_limiter-4.0.0.tar.gz |
|---|---|
| Size | 384.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
536a8df0bb2033f415a2212e19a3b7ddfea38585ac5a2444e1cfa986a697847c
|
|
BLAKE2b-256 checksum How to use checksums |
e45313ccac4772f7efd58e4b8308e2b8bfaef3a45a4420ec43966f2dbff904c8
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 30, 2025.
Transparency logRelease files / flask_limiter-4.0.0-py3-none-any.whl
| Download URL | flask_limiter-4.0.0-py3-none-any.whl |
|---|---|
| Size | 29.9 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
be62b462d5a052d21572d4c932e18a8da58cf9ddc18a34b6f1c21fa2ec35a395
|
|
BLAKE2b-256 checksum How to use checksums |
4e4425ebda35a714d79c085d3f3c2073d4eb5b70d2ed8794134e2c902128d60f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 30, 2025.
Transparency log
