Fix RateLimitExceeded: 429 Too Many Requests: Rate limit exceeded in Flask

This error occurs when Flask-Limiter detects too many requests from a client within the configured time window. It protects your API from abuse but can block legitimate users if misconfigured. Fix it by adjusting rate limits, implementing per-user limits with proper key functions, and adding a custom 429 error handler with Retry-After headers.

Reading the Stack Trace

Here's what each line means:

• File "/app/venv/lib/python3.12/site-packages/flask_limiter/extension.py", line 445, in __check_request_limit: Flask-Limiter's middleware checks the request count against the configured limit before the route handler runs.
• raise RateLimitExceeded(limit): The client has exceeded the allowed 10 requests per minute, so the limiter raises an exception.
• flask_limiter.errors.RateLimitExceeded: 429 Too Many Requests: 10 per 1 minute: The rate limit was set to 10 per minute, which may be too restrictive for normal application usage.

Common Causes

from flask_limiter import Limiter
limiter = Limiter(app, default_limits=['10 per minute'])  # too restrictive

limiter = Limiter(app, key_func=get_remote_address)
# All users behind a corporate proxy share 1 IP

# No @app.errorhandler(429) registered

The Fix

Use a custom key function that rate-limits by authenticated user ID rather than IP address, preventing shared-proxy collisions. Increase the default limit to a reasonable threshold and add a 429 error handler that includes a Retry-After header so clients know when to retry.

from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

limiter = Limiter(app, key_func=get_remote_address, default_limits=['10 per minute'])

from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

def get_rate_limit_key():
    if hasattr(g, 'current_user') and g.current_user:
        return f'user:{g.current_user.id}'
    return get_remote_address()

limiter = Limiter(app, key_func=get_rate_limit_key, default_limits=['200 per minute'])

@app.errorhandler(429)
def ratelimit_handler(e):
    return jsonify({
        'error': 'Rate limit exceeded',
        'retry_after': e.description
    }), 429, {'Retry-After': '60'}

Testing the Fix

import pytest
from app import create_app

@pytest.fixture
def client():
    app = create_app()
    app.config['TESTING'] = True
    app.config['RATELIMIT_ENABLED'] = True
    app.config['RATELIMIT_STORAGE_URI'] = 'memory://'
    return app.test_client()

def test_requests_within_limit_succeed(client):
    for _ in range(5):
        response = client.get('/api/data')
        assert response.status_code == 200

def test_429_includes_retry_after(client):
    # Temporarily set very low limit for testing
    app = client.application
    for _ in range(201):
        response = client.get('/api/data')
    assert response.status_code == 429
    assert 'Retry-After' in response.headers

Run your tests:

pytest tests/ -v

Pushing Through CI/CD

git checkout -b fix/flask-rate-limit-tuning,git add app/__init__.py app/routes.py,git commit -m "fix: adjust rate limits and add 429 error handler with Retry-After",git push origin fix/flask-rate-limit-tuning

Your CI config should look something like this:

name: CI
on:
  pull_request:
    branches: [main]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
          cache: 'pip'
      - run: pip install -r requirements.txt
      - run: pytest tests/ -v --tb=short
      - run: flake8 app/

The Full Manual Process: 18 Steps

Here's every step you just went through to fix this one bug:

1. Notice the error alert or see it in your monitoring tool
2. Open the error dashboard and read the stack trace
3. Identify the file and line number from the stack trace
4. Open your IDE and navigate to the file
5. Read the surrounding code to understand context
6. Reproduce the error locally
7. Identify the root cause
8. Write the fix
9. Run the test suite locally
10. Fix any failing tests
11. Write new tests covering the edge case
12. Run the full test suite again
13. Create a new git branch
14. Commit and push your changes
15. Open a pull request
16. Wait for code review
17. Merge and deploy to production
18. Monitor production to confirm the error is resolved

Total time: 30-60 minutes. For one bug.

pip install bugstack

import bugstack

bugstack.init(api_key=os.environ["BUGSTACK_API_KEY"])

Deploying the Fix (Manual Path)

1. Run pytest locally to verify rate limiting works as expected.
2. Open a pull request with the updated limiter config and error handler.
3. Wait for CI checks to pass on the PR.
4. Have a teammate review and approve the PR.
5. Merge to main and monitor 429 rates in staging to fine-tune limits.

Frequently Asked Questions