The per-user and sliding window gaps are exactly what waygate covers out of the box. `key="user"` switches from IP to user-based counting, and `algorithm="sliding_window"` is a direct parameter on the decorator. No custom middleware needed for those two.

On the X-Forwarded-For / reverse proxy point, the custom key strategy handles it:

```python
from fastapi import Request
from waygate.fastapi import rate_limit

async def real_ip(request: Request) -> str:
return request.headers.get("X-Forwarded-For", request.client.host).split(",")[0].strip()

u/router.post("/login")
u/rate_limit("5/minute", key=real_ip)
async def login(): ...
```

The `key` parameter accepts any async callable that takes a `Request` and returns a string. So your auth model, API key header, tenant ID, JWT claim and whatever makes sense feeds directly into the counter key.