I found this in the recipes:

Rate limiting a route by current user (using Flask-Login):

@route("/test")
@login_required
@limiter.limit("1 per day", key_func = lambda : current_user.username)
def test_route():
    return "42"

UPDATED: added simple example

Here is a simple Flask app implementing the recipe to give you better idea:

from flask import Flask, redirect
from flask_login import (
    LoginManager, 
    UserMixin, 
    current_user, 
    login_required,
    login_user, 
    logout_user
)
from flask_limiter import Limiter                    

app = Flask(__name__)

# flask-login
app.secret_key = 'super secret string' 
login_manager = LoginManager()
login_manager.init_app(app)

# flask-limiter
limiter = Limiter(app)

# user class
class User(UserMixin):
    def __init__(self, id):
        self.id = id
        self.username = id

# memory storage
users = [User('user')]

@login_manager.user_loader
def load_user(user_id):
    return users[0]

@app.route('/')
def index():
    return 'Hello, World!'

@app.route('/login')
def login():
    if not current_user.is_authenticated:
        login_user(users[0])
    return redirect('/secured')

@app.route('/logout')
@login_required
def logout():
    logout_user()
    return redirect('/')

@app.route('/secured')
@login_required
@limiter.limit("2 per day", key_func = lambda : current_user.username)
def secured():
    return f"Hello, {current_user.id}"

if __name__ == '__main__':    
    app.run()

There have been issues raised in the past around accidentally shipping the in-memory storage since it is the default and not getting the expected rate limits since "1/hour/user" distributed across n worker processes ends up meaning ~ "n/hour/user".

The warning is simply there to ensure everyone gets a heads up early on.

Additionally, the in-memory storage implementation was mostly intended to be a reference implementation and is probably not as optimized as it could be.