Reduce abuse
Public API endpoint
AI Tools · Const
Rate Limiting
Rate limiting protects an API by restricting each client's requests within a time window. The documented example uses Upstash Redis and Upstash Ratelimit to allow five requests every 30 seconds and reject excess traffic.
How it works
The documented approach combines Upstash Redis with Upstash Ratelimit. Configure a limiter such as five requests per 30 seconds, call ratelimit.limit with a client identifier, and reject unsuccessful checks with a 429 response before handling the request.
Syntax
const ratelimit = new Ratelimit({ redis, limiter: Ratelimit.fixedWindow(5, '30s') });
const { success, remaining } = await ratelimit.limit(clientKey);Parameters
| Name | Type | Description |
|---|---|---|
ip | string | Client identifier used as the rate-limit key, represented by the request IP in the example. |
Returns
The page's rate-limit call returns success and remaining; the endpoint returns a 429 response when unsuccessful and otherwise continues to produce its normal response.
Key points
- Rate limiting adds an abuse-protection boundary around an API.
- A policy defines the maximum requests allowed for one client during a time interval.
- The page's implementation uses Upstash Redis as storage and Upstash Ratelimit for enforcement.
- The example permits five requests in each 30-second fixed window.
- Call
limitwith the client key and read both whether it passed and how many requests remain. - A request that fails the check is rejected with HTTP status 429.
Common mistakes
- Without a limit, excessive requests can harm service performance and create avoidable costs.
- For a streaming endpoint, the example sets the route's maximum duration to 30 seconds.
- The failed-limit branch must stop processing and return a 429 response rather than continuing to the model call.
Example: Protect an API endpoint with a fixed-window limiter
import { Redis } from '@upstash/redis';
import { Ratelimit } from '@upstash/ratelimit';
const ratelimit = new Ratelimit({
redis: Redis.fromEnv(),
limiter: Ratelimit.fixedWindow(5, '30s'),
});
export async function POST(req: Request) {
const ip = req.headers.get('x-forwarded-for') ?? 'ip';
const { success } = await ratelimit.limit(ip);
if (!success) return new Response('Ratelimited!', { status: 429 });
return new Response('OK');
}Creates a fixed-window limiter backed by Upstash Redis, checks the caller identifier, and returns HTTP 429 when the request exceeds the configured limit.
When to use it
Control request volume
Model-generation route
Reject over-limit callers before generation
Streaming response handler
Interview questions
QWhat problem does rate limiting solve, and how is the documented window configured?
Rate limiting protects an API by restricting how many requests a client may make during a defined period. The page demonstrates a fixed window of five requests per 30 seconds, using an identifier such as an IP address.
Follow-up: How should an endpoint signal that the limit was exceeded? Return an HTTP 429 response and avoid invoking the downstream model or application logic.
QHow do you implement the documented Upstash-based limiter?
Create an Upstash Redis client from environment variables, pass it to Ratelimit, and configure a limiter with Ratelimit.fixedWindow. Then call ratelimit.limit with the client key and inspect success.
Follow-up: What additional result can be used for response metadata? The limit call also returns remaining, which can be used to expose or log the number of requests left.
QWhat happens when a request fails the rate-limit check?
The request identifier is used as the rate-limit key; the example derives it from the request IP and falls back to 'ip'. If success is false, the handler returns new Response('Ratelimited!', { status: 429 }).
Follow-up: Why is key selection significant? A shared fallback key can rate-limit unrelated callers together, so production code should use a reliable per-client identifier.
Related
Upstash RedisUpstash RatelimitRatelimit.fixedWindowratelimit.limitmaxDurationHTTP 429