Rate limiting is the simplest defense against abuse. Here's how to add it

to a FastAPI app in 2026, step by step.

Install

pip install drogue[fastapi]

Enter fullscreen mode

Exit fullscreen mode

Basic rate limiting

from fastapi import FastAPI from drogue.adapters.fastapi import DrogueLimiter

app = FastAPI () limiter = DrogueLimiter ( app , default_limits = [ " 100/minute " ])

@app.get ( " /api/data " ) @limiter.limit ( " 10/minute " ) async def get_data (): return { " data " : " value " }

Enter fullscreen mode

Exit fullscreen mode

That's it. Every request gets a limit. Exceed it and you get 429 with

standard headers: X-RateLimit-Limit , X-RateLimit-Remaining , Retry-After .

Per-route limits

@app.get ( " /api/public " ) @limiter.limit ( " 100/minute " ) async def public (): return { " ok " : True }

@app.post ( " /api/login " ) @limiter.limit ( " 5/minute " ) # strict: brute force protection async def login ( credentials : dict ): return { " token " : " ...…