Fix HTTPException: 429 Too Many Requests: Rate limit exceeded in FastAPI

This error occurs when your rate limiter blocks requests but is misconfigured, applying limits too aggressively or not distinguishing between authenticated and anonymous users. Fix it by properly configuring slowapi or a custom rate limiter with appropriate limits per endpoint, user-based keys, and clear Retry-After headers.

Reading the Stack Trace

Here's what each line means:

• File "/app/venv/lib/python3.11/site-packages/slowapi/extension.py", line 182, in check_rate_limit: slowapi's rate limiter checked the request count for this client and determined the limit has been exceeded.
• File "/app/venv/lib/python3.11/site-packages/slowapi/middleware.py", line 46, in dispatch: The rate limiting middleware intercepts the request before it reaches the endpoint handler.
• File "/app/src/main.py", line 35, in get_api_data: The endpoint never executes because the rate limiter raises HTTPException before the function is called.

Common Causes

from slowapi import Limiter
from slowapi.util import get_remote_address

limiter = Limiter(key_func=get_remote_address)  # All users share one IP behind proxy

@app.get("/api/data")
@limiter.limit("10/minute")
async def get_api_data(request: Request):
    return {"data": fetch_data()}

@app.get("/api/config")
@limiter.limit("5/minute")  # Too low for an endpoint called on every page load
async def get_config(request: Request):
    return {"theme": "dark", "locale": "en"}

# No custom exception handler registered
app = FastAPI()
app.state.limiter = limiter
# Missing: app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)

The Fix

Use a custom key function that extracts the real client IP from the X-Forwarded-For header when behind a reverse proxy. Increase the rate limit to a realistic threshold for the endpoint's usage pattern. Register the RateLimitExceeded exception handler to return proper 429 responses with Retry-After headers.

from slowapi import Limiter
from slowapi.util import get_remote_address

limiter = Limiter(key_func=get_remote_address)
app.state.limiter = limiter

@app.get("/api/data")
@limiter.limit("10/minute")
async def get_api_data(request: Request):
    return {"data": fetch_data()}

from slowapi import Limiter, _rate_limit_exceeded_handler
from slowapi.errors import RateLimitExceeded
from starlette.requests import Request
from starlette.responses import JSONResponse

def get_real_client_ip(request: Request) -> str:
    forwarded = request.headers.get("X-Forwarded-For")
    if forwarded:
        return forwarded.split(",")[0].strip()
    return request.client.host

limiter = Limiter(key_func=get_real_client_ip)
app.state.limiter = limiter
app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)

@app.get("/api/data")
@limiter.limit("100/minute")
async def get_api_data(request: Request):
    return {"data": fetch_data()}

Testing the Fix

import pytest
from fastapi.testclient import TestClient
from app.main import app

client = TestClient(app)


def test_request_within_rate_limit():
    response = client.get("/api/data")
    assert response.status_code == 200


def test_rate_limit_headers_present():
    response = client.get("/api/data")
    assert "x-ratelimit-limit" in response.headers or response.status_code == 200


def test_rate_limit_exceeded_returns_429():
    # Send requests until rate limit is hit
    for _ in range(150):
        response = client.get("/api/data")
        if response.status_code == 429:
            assert "retry-after" in response.headers or "Retry-After" in response.headers
            break


def test_different_ips_have_separate_limits():
    response1 = client.get(
        "/api/data",
        headers={"X-Forwarded-For": "1.2.3.4"},
    )
    response2 = client.get(
        "/api/data",
        headers={"X-Forwarded-For": "5.6.7.8"},
    )
    assert response1.status_code == 200
    assert response2.status_code == 200

Run your tests:

pytest tests/test_rate_limit.py -v

Pushing Through CI/CD

git checkout -b fix/fastapi-rate-limit,git add src/main.py tests/test_rate_limit.py,git commit -m "fix: use real client IP for rate limiting and add exception handler",git push origin fix/fastapi-rate-limit

Your CI config should look something like this:

name: CI
on:
  pull_request:
    branches: [main]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          cache: 'pip'
      - run: pip install -r requirements.txt
      - run: pytest --tb=short -q

The Full Manual Process: 18 Steps

Here's every step you just went through to fix this one bug:

1. Notice the error alert or see it in your monitoring tool
2. Open the error dashboard and read the stack trace
3. Identify the file and line number from the stack trace
4. Open your IDE and navigate to the file
5. Read the surrounding code to understand context
6. Reproduce the error locally
7. Identify the root cause
8. Write the fix
9. Run the test suite locally
10. Fix any failing tests
11. Write new tests covering the edge case
12. Run the full test suite again
13. Create a new git branch
14. Commit and push your changes
15. Open a pull request
16. Wait for code review
17. Merge and deploy to production
18. Monitor production to confirm the error is resolved

Total time: 30-60 minutes. For one bug.

pip install bugstack

import bugstack

bugstack.init(api_key=os.environ["BUGSTACK_API_KEY"])

Deploying the Fix (Manual Path)

1. Run the test suite locally to confirm rate limiting works with the correct client IP extraction.
2. Open a pull request with the rate limiter configuration fix.
3. Wait for CI checks to pass on the PR.
4. Have a teammate review and approve the PR.
5. Merge to main and monitor 429 response rates in staging to tune limits.

Frequently Asked Questions