Protect your API from abuse
Protect your API before someone hammers it. Fair usage enforced automatically.
Categories: rate limiting, api security, throttling, ddos, abuse prevention, api protection, cloudflare, redis, security, limits
Tools that power the Protect your API from abuse stack
Cloudflare — Edge rate limiting
Block abusive traffic and throttle requests at the network edge before hitting your server
Upstash — Serverless Redis
Serverless Redis with a per-request pricing model ideal for rate limiting counters
Kong — API gateway
Open-source API gateway with built-in rate limiting, auth, and routing plugins
Express Rate Limit — Node.js middleware
Drop-in rate limiting middleware for Express apps with flexible storage backends
Setup guide
- Cloudflare: Add your domain to Cloudflare and proxy traffic through their network. In Security → WAF → Rate Limiting Rules, create a rule that matches your API path pattern. Set a threshold (e.g., 100 requests per minute per IP) and choose the action: block, challenge, or log. Cloudflare enforces this at the edge before requests reach your origin server. (open)
- Upstash: Create a free Upstash Redis database and copy the REST URL and token. In your API handler, use the @upstash/ratelimit package to create a sliding window limiter keyed by user ID or IP address. Return a 429 status with a Retry-After header when the limit is exceeded. Upstash stores counters globally with sub-millisecond latency. (open)
- Kong: Deploy Kong Gateway in front of your API services. Enable the Rate Limiting plugin on a route or service and configure limits per consumer, IP, or API key. Kong stores counters in memory by default or in Redis for multi-instance deployments. Consumers exceeding limits receive a 429 with X-RateLimit-Remaining: 0 headers. (open)
- Express Rate Limit: Install express-rate-limit with npm. Create a limiter with rateLimit({ windowMs: 60000, max: 100 }) and apply it as middleware to your router. Use rate-limit-redis as the store so limits persist across server restarts and multiple instances. Add X-RateLimit headers to responses so API clients can self-throttle before hitting the limit. (open)