FastAPI rate limiting with Redis token bucket

<p>I need to rate limit my FastAPI API endpoints. I want different limits for read vs write operations (e.g., 60 reads/min, 20 writes/min per API key). The rate limiter must be atomic to handle concurrent requests correctly and must not block the request if Redis is down.</p>

<p>Use a Lua-based token bucket in Redis for atomic rate limiting:</p> <div class="highlight"><pre><span></span><code><span class="c1">-- rate_limit.lua (embed as string in Python)</span> <span class="kd">local</span><span class="w"> </span><span class="nv">key</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="nv">KEYS</span><span class="p">[</span><span class="mi">1</span><span class="p">]</span> <span class="kd">local</span><span class="w"> </span><span class="nv">capacity</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="nb">tonumber</span><span class="p">(</span><span class="nv">ARGV</span><span class="p">[</span><span class="mi">1</span><span class="p">])</span> <span class="kd">local</span><span class="w"> </span><span class="nv">refill_rate</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="nb">tonumber</span><span class="p">(</span><span class="nv">ARGV</span><span class="p">[</span><span class="mi">2</span><span class="p">])</span><span class="w"> </span><span class="c1">-- tokens per second</span> <span class="kd">local</span><span class="w"> </span><span class="nv">now</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="nb">tonumber</span><span class="p">(</span><span class="nv">ARGV</span><span class="p">[</span><span class="mi">3</span><span class="p">])</span><span class="w"> </span><span class="c1">-- current time in ms</span> <span class="kd">local</span><span class="w"> </span><span class="nv">data</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="nv">redis</span><span class="p">.</span><span class="nf">call</span><span class="p">(</span><span class="s1">'HMGET'</span><span class="p">,</span><span class="w"> </span><span class="nv">key</span><span class="p">,</span><span class="w"> </span><span class="s1">'tokens'</span><span class="p">,</span><span class="w"> </span><span class="s1">'last_refill'</span><span class="p">)</span> <span class="kd">local</span><span class="w"> </span><span class="nv">tokens</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="nb">tonumber</span><span class="p">(</span><span class="nv">data</span><span class="p">[</span><span class="mi">1</span><span class="p">])</span><span class="w"> </span><span class="ow">or</span><span class="w"> </span><span class="nv">capacity</span> <span class="kd">local</span><span class="w"> </span><span class="nv">last_refill</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="nb">tonumber</span><span class="p">(</span><span class="nv">data</span><span class="p">[</span><span class="mi">2</span><span class="p">])</span><span class="w"> </span><span class="ow">or</span><span class="w"> </span><span class="nv">now</span> <span class="kd">local</span><span class="w"> </span><span class="nv">elapsed</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">(</span><span class="nv">now</span><span class="w"> </span><span class="o">-</span><span class="w"> </span><span class="nv">last_refill</span><span class="p">)</span><span class="w"> </span><span class="o">/</span><span class="w"> </span><span class="mf">1000.0</span> <span class="kd">local</span><span class="w"> </span><span class="nv">new_tokens</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="nb">math.min</span><span class="p">(</span><span class="nv">capacity</span><span class="p">,</span><span class="w"> </span><span class="nv">tokens</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="nv">elapsed</span><span class="w"> </span><span class="o">*</span><span class="w"> </span><span class="nv">refill_rate</span><span class="p">)</span> <span class="kr">if</span><span class="w"> </span><span class="nv">new_tokens</span><span class="w"> </span><span class="o">&gt;=</span><span class="w"> </span><span class="mi">1</span><span class="w"> </span><span class="kr">then</span> <span class="w"> </span><span class="nv">redis</span><span class="p">.</span><span class="nf">call</span><span class="p">(</span><span class="s1">'HMSET'</span><span class="p">,</span><span class="w"> </span><span class="nv">key</span><span class="p">,</span><span class="w"> </span><span class="s1">'tokens'</span><span class="p">,</span><span class="w"> </span><span class="nv">new_tokens</span><span class="w"> </span><span class="o">-</span><span class="w"> </span><span class="mi">1</span><span class="p">,</span><span class="w"> </span><span class="s1">'last_refill'</span><span class="p">,</span><span class="w"> </span><span class="nv">now</span><span class="p">)</span> <span class="w"> </span><span class="nv">redis</span><span class="p">.</span><span class="nf">call</span><span class="p">(</span><span class="s1">'EXPIRE'</span><span class="p">,</span><span class="w"> </span><span class="nv">key</span><span class="p">,</span><span class="w"> </span><span class="mi">120</span><span class="p">)</span> <span class="w"> </span><span class="kr">return</span><span class="w"> </span><span class="mi">1</span><span class="w"> </span><span class="c1">-- allowed</span> <span class="kr">else</span> <span class="w"> </span><span class="kr">return</span><span class="w"> </span><span class="mi">0</span><span class="w"> </span><span class="c1">-- rate limited</span> <span class="kr">end</span> </code></pre></div> <div class="highlight"><pre><span></span><code><span class="k">async</span> <span class="k">def</span><span class="w"> </span><span class="nf">check_rate_limit</span><span class="p">(</span><span class="n">redis</span><span class="p">,</span> <span class="n">api_key</span><span class="p">:</span> <span class="nb">str</span><span class="p">,</span> <span class="n">capacity</span><span class="p">:</span> <span class="nb">int</span><span class="p">,</span> <span class="n">per_minute</span><span class="p">:</span> <span class="nb">int</span><span class="p">)</span> <span class="o">-&gt;</span> <span class="nb">bool</span><span class="p">:</span> <span class="w"> </span><span class="sd">"""Returns True if request is allowed."""</span> <span class="k">try</span><span class="p">:</span> <span class="n">key</span> <span class="o">=</span> <span class="sa">f</span><span class="s1">'rl:</span><span class="si">{</span><span class="n">api_key</span><span class="si">}</span><span class="s1">'</span> <span class="n">now</span> <span class="o">=</span> <span class="nb">int</span><span class="p">(</span><span class="n">time</span><span class="o">.</span><span class="n">time</span><span class="p">()</span> <span class="o">*</span> <span class="mi">1000</span><span class="p">)</span> <span class="n">result</span> <span class="o">=</span> <span class="k">await</span> <span class="n">redis</span><span class="o">.</span><span class="n">eval</span><span class="p">(</span><span class="n">LUA_SCRIPT</span><span class="p">,</span> <span class="mi">1</span><span class="p">,</span> <span class="n">key</span><span class="p">,</span> <span class="n">capacity</span><span class="p">,</span> <span class="n">per_minute</span><span class="o">/</span><span class="mf">60.0</span><span class="p">,</span> <span class="n">now</span><span class="p">)</span> <span class="k">return</span> <span class="nb">bool</span><span class="p">(</span><span class="n">result</span><span class="p">)</span> <span class="k">except</span> <span class="ne">Exception</span><span class="p">:</span> <span class="k">return</span> <span class="kc">True</span> <span class="c1"># Fail open if Redis unavailable</span> <span class="c1"># Dependency:</span> <span class="k">async</span> <span class="k">def</span><span class="w"> </span><span class="nf">require_write_limit</span><span class="p">(</span><span class="n">api_key</span><span class="p">:</span> <span class="n">CurrentAPIKey</span><span class="p">,</span> <span class="n">redis</span><span class="o">=</span><span class="n">Depends</span><span class="p">(</span><span class="n">get_redis</span><span class="p">)):</span> <span class="n">allowed</span> <span class="o">=</span> <span class="k">await</span> <span class="n">check_rate_limit</span><span class="p">(</span><span class="n">redis</span><span class="p">,</span> <span class="n">api_key</span><span class="p">,</span> <span class="n">capacity</span><span class="o">=</span><span class="mi">20</span><span class="p">,</span> <span class="n">per_minute</span><span class="o">=</span><span class="mi">20</span><span class="p">)</span> <span class="k">if</span> <span class="ow">not</span> <span class="n">allowed</span><span class="p">:</span> <span class="k">raise</span> <span class="n">HTTPException</span><span class="p">(</span><span class="mi">429</span><span class="p">,</span> <span class="s1">'Write rate limit exceeded'</span><span class="p">)</span> </code></pre></div> <p>Key points: - Lua scripts run atomically on Redis — no race conditions - Fail open (return True) when Redis is unavailable — prefer availability over strict limits - Token bucket is smoother than fixed window (allows bursts up to capacity) - Use separate keys per API key and per endpoint category (read vs write)</p>