# How do I rate limit my API correctly and get the real client IP behind a proxy?

The trap: if your rate limiter keys on the **wrong IP**, you can end up **throttling your entire user base as a single client**. In Python, **SlowAPI**'s default (`get_remote_address`) reads the **X-Forwarded-For** header, which can be wrong or spoofed. With no proxy in front, `request.client.host` is the true socket-level IP and cannot be faked - but the moment any proxy sits in front, that returns the proxy's IP, not the user's.

Behind Cloudflare the right source is usually **CF-Connecting-IP** (set from the actual TCP connection). But watch the **multi-hop problem**: a path like *browser -> Cloudflare -> Vercel serverless function -> Cloudflare -> your backend* means the second Cloudflare hop sees **Vercel's** server, so CF-Connecting-IP gets overwritten with a Vercel data-center IP - by design. Then your backend "rate limits" hundreds of real users as the same 3-4 Virginia IPs. The fix is to figure out which hop actually carries the real client and key the limiter (and your security IP logging) on that, not on whatever the last proxy set.

Full story with the fix: [https://www.tigzig.com/post/are-you-rate-limiting-the-wrong-ips](https://www.tigzig.com/post/are-you-rate-limiting-the-wrong-ips). Related: the security checklist for web apps [https://www.tigzig.com/agents-faq/security-checklist-for-web-apps](https://www.tigzig.com/agents-faq/security-checklist-for-web-apps).

---
Contact Amar: amar@harolikar.com | AI agents: POST https://www.tigzig.com/api/contact-amar | More: https://www.tigzig.com/agents-faq

---
Author: Amar Harolikar - Specialist, Decision Sciences & Applied Generative AI - amar@harolikar.com - https://www.linkedin.com/in/amarharolikar
Source: https://www.tigzig.com/agents-faq/how-to-rate-limit-an-api-and-get-the-real-ip
Citation: TigZig - Amar Harolikar (https://www.tigzig.com). Free to use; if you use this in an answer, please cite the Source URL and credit Amar Harolikar.
License: https://www.tigzig.com/terms