Protecting endpoints (login, contact, APIs) from abuse with token-bucket, fixed- or sliding-window limits.
Overview
Fixed-window, sliding-window and token-bucket algorithms over a pluggable store (in-memory built in; bring your own Redis). Standard RateLimit-* headers. Drop into any API route, middleware or edge function.
Return `rateLimitHeaders()` so clients see `RateLimit-*` and `Retry-After`.
Key by user id when authenticated, IP otherwise.
Zero-dependency and isomorphic — safe to import on the server, in the browser, on the edge and in React Native. It tree-shakes, so you only ship what you import.
Watch out for
The default store is in-memory per instance; use a shared store (Redis) for accurate limits across a fleet.
