Protect your API from abuse

Tools that power the Protect your API from abuse stack

• Cloudflare — Edge rate limiting

  Block abusive traffic and throttle requests at the network edge before hitting your server

  See all stacks using Cloudflare

• Upstash — Serverless Redis

  Serverless Redis with a per-request pricing model ideal for rate limiting counters

  See all stacks using Upstash

• Kong — API gateway

  Open-source API gateway with built-in rate limiting, auth, and routing plugins

  See all stacks using Kong

• Express Rate Limit — Node.js middleware

  Drop-in rate limiting middleware for Express apps with flexible storage backends

  See all stacks using Express Rate Limit

Setup guide

1. Cloudflare: If traffic passes through Cloudflare, check which rate-limiting rules and matching fields your plan supports. Define the protected path, threshold and response, then test with controlled traffic. Confirm normal users remain unaffected and understand which origin requests bypass the edge. (Read official instructions)
2. Upstash: Use Upstash Redis with the rate-limiting library appropriate to your runtime. Keep credentials server-side, choose a key based on the authenticated user or carefully handled client IP, and select a region suitable for the application. Test allowed requests, a 429 after the limit, reset timing and datastore failures. Measure latency in your deployment rather than promising globally sub-millisecond responses. (Read official instructions)
3. Kong: If your API already uses Kong, configure the rate-limiting plugin supported by your edition and deployment. Choose the consumer identity, time window and shared storage strategy for multiple gateway instances. Test limits across instances and inspect the actual response headers and 429 behavior. (Read official instructions)
4. Express Rate Limit: Install compatible versions of express-rate-limit and your shared-store adapter. Configure rateLimit({ windowMs: 60000, limit: 100, standardHeaders: 'draft-8', legacyHeaders: false }) and mount it on the protected route. Wire the Redis client into the documented rate-limit-redis store; installing the package alone does not enable shared counters. Configure trusted proxies to match your deployment. Test allowed requests, the 429 response, reset and headers across two application instances. The example allows 100 requests per minute; choose limits for your route rather than treating this as a universal safe threshold. (Read official instructions)

   Check: Controlled requests reach the intended threshold, return 429, reset correctly and share counters across instances where required; normal traffic stays usable.