Flask-Limiter

Flask-Limiter adds request rate limiting to Flask applications, letting you configure limits at multiple levels — global application-wide defaults, per-blueprint, or per-route decorators — using a simple "N per minute"-style syntax. It’s built on top of the limits library, giving it pluggable storage backends (in-memory, Redis, Memcached) so limits can be enforced consistently across multiple app instances in production.

The extension also emits standard X-RateLimit-* response headers, supports exempting specific routes or user roles, and includes an in-memory fallback mode so limits keep working (in a degraded, single-process form) if the configured storage backend becomes unreachable.

What You Get

• A Limiter extension object with @limiter.limit(...) decorators for per-route rate limits
• Application-wide default limits and per-blueprint limit scoping
• Pluggable storage backends (in-memory, Redis, Memcached, and more) via the limits package
• Standard X-RateLimit-* response headers and a RequestLimit object describing the active limit
• An in-memory fallback mode so limits keep functioning if the configured storage backend goes down

Common Use Cases

• Protecting login and password-reset endpoints from brute-force attempts
• Enforcing per-API-key or per-user request quotas on a public API
• Applying different rate limits across blueprints (e.g. stricter limits on write endpoints)
• Running consistent rate limits across multiple app instances via a shared Redis backend

Under The Hood

Architecture - The extension centers on _extension.py (over 1,100 lines), which defines the Limiter class that hooks into Flask’s request lifecycle (before_request/after_request) to evaluate and enforce limits; _manager.py’s LimitManager resolves the applicable set of limits for a given route by combining application-wide, blueprint, and route-level declarations defined in _limits.py, while actual limit storage and counting is delegated to the separate limits library via storage_from_string().

Tech Stack - A focused Python 3.10+ package (~2,600 lines) depending directly on limits (which itself provides Redis/Memcached/MongoDB storage backends), Flask>=2, ordered-set, and typing_extensions; built with a modern pyproject.toml and uv.lock, with a _cli.py/commands.py pair adding a flask limiter CLI command for inspecting configured limits.

Code Quality - Ten test modules exercise the core limiter, CLI commands, and storage integration (the repo’s docker-compose.yml spins up Redis/Memcached for integration tests), and CI/codecov badges in the README indicate an established test pipeline; however, GitHub activity data shows low recent commit velocity (0.33 commits/month), suggesting the project is stable but only lightly maintained at present.

API Design - The primary interface is a Limiter(app) extension plus @limiter.limit("5 per minute")-style decorators using a human-readable limit string syntax, which keeps day-to-day usage simple; more advanced features like dynamic limits, exemption scopes, and custom key functions are opt-in additions layered on top of that same decorator, so the API scales in complexity only as needed.