Should I remove DRF throttling?

For routes your customers call with API keys, yes — ReqKey applies the limit on their plan and you avoid counting twice. You can keep AnonRateThrottle on public endpoints that don’t need a key.

Where do the settings go?

A REQKEY dict in settings.py holds the API ID, key header, and excluded paths. The project key stays in the REQKEY_PROJECT_KEY environment variable.

Where do I set each customer’s rate limit?

On their plan or on the customer (consumer) in ReqKey — a number of requests per window from 1 second to 24 hours, shared by all of that customer’s keys. Your Django code never hard-codes a limit, so upgrading a customer is a dashboard change, not a deploy.

Does ReqKey add latency to Django requests?

A check averages under 5ms. ReqKey runs inside your app as middleware, not as a gateway in front of it, so responses go straight back to your customer.

What happens if ReqKey can’t be reached?

You choose: fail closed and answer 503, or fail open and let requests through. Invalid keys are denied either way, and a validation is never retried, so no one is charged twice.

Django guide · Python SDK

Django rate limiting,per API key and per plan.

Add one line to MIDDLEWARE. Every request is checked against the caller’s key, charged against their credits, and held to their plan’s limit — sync or async views alike.

Start building free Python SDK docs

Keys issued per customer
Credits that refill
Limits per plan, not per process

Official SDKs with drop-in middleware for the stack you already run

Python
Node.js
Go
Rust
PHP
.NET
Java

API requests validated: 100M+
Average key validation: <5ms
Average analytics ingest: <5ms
Check and log, end to end: <10ms

The usual Django rate limiter counts requests. It doesn’t know your customers.

Django REST Framework ships throttle classes: AnonRateThrottle by IP and UserRateThrottle by logged-in user, with rates set in settings and counts kept in Django’s cache.

With DRF throttlingtoday

# settings.py — DRF throttlingREST_FRAMEWORK = {
    "DEFAULT_THROTTLE_CLASSES": [
        "rest_framework.throttling.AnonRateThrottle",
        "rest_framework.throttling.UserRateThrottle",
    ],
    "DEFAULT_THROTTLE_RATES": {
        "anon": "100/day",
        "user": "1000/day",
    },
}

Counts live in Django’s cache — LocMemCache is per process, so a shared cache is required first
Throttles by logged-in user, not by the API key a customer calls with
No API keys: issuing, hashing, scoping, and revoking them is still yours to build
No credit balance: a request can’t cost 5 on one route and 1 on another, or refill each month
Different limits per plan mean writing custom throttle classes
No per-customer usage log to answer “why was I blocked?” or bill against

With ReqKey in Djangoone middleware

API keys issued per customer, prefixed, hashed, and revocable from the dashboard
A credit balance per customer — price each route, refill every hour, day, week, or month
Rate limits set per plan, shared by all of a customer’s keys, from 1 second to 24 hours
The same count on every worker, instance, and region — no Redis to run
Over the limit? A 429 with Retry-After, and no credits charged
Every request logged per customer — status, latency, endpoint — in under 5ms

Your view reads the verdict from request.reqkey. See the code

Django in three steps, one of them code.

ReqKey runs inside your API, not in front of it. Your server asks one question per request and gets an answer in under 5ms.

1
Install the SDK
pip install "reqkey[django]"
2
Set your project key
Copy it from the dashboard into REQKEY_PROJECT_KEY. It stays on your server.
3
Add the Django middleware
Every request is checked, charged, and logged before your handler runs.

settings.pypip install "reqkey[django]"

# settings.py — the project key stays in the environment
REQKEY = {
    "API_ID": "api_payments",
    "MODE": "both",
    "KEY_NAME": "X-MyStartup-Key",
    "EXCLUDE_PATHS": ("/health", "/admin/*", "/static/*"),
}
 
MIDDLEWARE = [
    "django.middleware.security.SecurityMiddleware",
    "reqkey.django.ReqKeyMiddleware",  # add this line
    # ...the rest of your middleware
]
 
# views.py — Django picks sync or async automatically
def create_payment(request):
    decision = request.reqkey
    return JsonResponse({"created": True, "credits_remaining": decision.credits_remaining})

Also in Python: FastAPI, FlaskFull Python reference

Every request gets one of these answers

200Valid key, credits charged — your handler runs
402Out of credits
403Key disabled, or not allowed on this API
429Over the rate limit — no credits charged

Where ReqKey sits

Your customer

Your APIReqKey, under 5ms

Your handler

Responses go straight back to your customer. ReqKey sees the key check and the log line, nothing else.

Credits

Charge each route what it costs you.

A lookup can cost 1 credit and a render 5, from the same balance. Excluded paths are never validated, charged, or recorded. In Python:

Per-route credits · Python

# Exact paths or trailing-* prefixes: never validated, charged, or recorded
exclude_paths=("/health", "/openapi.json", "/docs/*", "/cron/*")
 
# Or decide per request with a sync or async resolver
should_protect=lambda request: request.url.path.startswith("/api/")
 
# Charge different endpoints differently
def credits_for(request):
    if request.method == "POST" and request.url.path == "/images":
        return 5
    return 1
 
app.add_middleware(ReqKeyMiddleware, ..., credits=credits_for)

Rate limits

Set limits on plans, not in code.

Your Django code never hard-codes a number. Each plan carries its credits, refill, and rate limit; moving a customer to Pro changes all three with no deploy.

PlanCreditsRate limit

Free1,000 / month5 req / s

Pro50,000 / month50 req / s

Scale1,000,000 / month500 req / s

429Over the limit, a call is answered with Retry-After and costs nothing — no credits and no quota.

Example plans. You name them and pick the numbers.

Notes for Django teams hit in production.

Sync and async, picked for you

The middleware detects whether your chain is sync or async and uses the matching client, so ASGI and WSGI deployments both work unchanged.

Works with or without DRF

It is plain Django middleware, so function views, class-based views, DRF viewsets, and Django Ninja routes are all covered.

Keep the admin out of it

Add "/admin/*" and "/static/*" to EXCLUDE_PATHS so staff pages and assets are never validated or counted.

Django rate limiting: the questions teams ask.

Something else? Ask the team or read the docs.

For routes your customers call with API keys, yes — ReqKey applies the limit on their plan and you avoid counting twice. You can keep AnonRateThrottle on public endpoints that don’t need a key.
A REQKEY dict in settings.py holds the API ID, key header, and excluded paths. The project key stays in the REQKEY_PROJECT_KEY environment variable.
On their plan or on the customer (consumer) in ReqKey — a number of requests per window from 1 second to 24 hours, shared by all of that customer’s keys. Your Django code never hard-codes a limit, so upgrading a customer is a dashboard change, not a deploy.
A check averages under 5ms. ReqKey runs inside your app as middleware, not as a gateway in front of it, so responses go straight back to your customer.
You choose: fail closed and answer 503, or fail open and let requests through. Invalid keys are denied either way, and a validation is never retried, so no one is charged twice.

More Python guides.

Other languages

Ship API keys in Djangoin five minutes.

Free for your first 5 million requests every month. No card, no gateway, no rewrite.

Start building free Read the docs