You're adding rate limiting to a Python web app. The usual suspects are slowapi, flask-limiter, django-ratelimit, and the limits library. There's also drogue. Here's how they compare.

The short version

drogue slowapi flask-limiter limits

request: Request in signatures No Yes Yes N/A (standalone)

FastAPI Yes Yes No Via adapter

Django Yes No No Via adapter

Flask Yes No Yes Via adapter

Algorithms 5 (Token Bucket, Sliding, Fixed, GCRA, Leaky) 1 (Fixed Window) 1 (Fixed Window) 3

WebSocket Yes No No No

DDoS detection Yes No No No

Auto-ban Yes No No No

CAPTCHA challenges Yes No No No

Shadow mode Yes No No No

Custom 429 body error_renderer Custom handler Custom handler N/A

Zero runtime deps Yes No (starlette) No (flask) No

The request: Request problem

This is the biggest difference and the reason drogue exists.

slowapi requires you to add request: Request to every decorated endpoint:

# slowapi from slowapi import Limiter from slowapi.util import get_remote_address from starlette.requests import…