API Rate Limiting — Animate | AI Wisdom

← Back to topic
🎞 ANIMATE · Mode 3 of 5 · +100 XP— API Rate Limiting
📋Token Bucket
⚙️Sliding Window
🔄Distributed
✅Headers
🎯 Next: Test →
Step 1 / 4
Speed
Token Bucket
windowMs + max — fixed window rate limiting💡 Analogy
Like a tap with a limited daily flow — once the quota is used, you wait for next day's reset.
windowMs defines the time window (15 min). max defines max requests in that window. After max is hit, requests return 429 Too Many Requests.
Console Output
> Request: 99/100 in current window — OK
> Request: 100/100 — last allowed
> Request: 429 Too Many Requests
> RateLimit-Remaining: 0
●rate-limiter.ts
Token BucketL7–13
1import { rateLimit } from 'express-rate-limit';
2import RedisStore from 'rate-limit-redis';
3import { createClient } from 'redis';
4 
5const redis = createClient({ url: process.env.REDIS_URL });
6 
7// Global rate limit — 100 requests per 15 minutes per IP
8const globalLimiter = rateLimit({
9  windowMs: 15 * 60 * 1000, // 15 minutes
10  max: 100,                  // per windowMs per IP
11  standardHeaders: 'draft-7', // Emit RateLimit headers
12  legacyHeaders: false,
13  store: new RedisStore({    // Distributed state for multiple servers
14    sendCommand: (...args: string[]) => redis.sendCommand(args),
15  }),
16  handler: (req, res) => {
17    res.status(429).json({
18      error: 'Too many requests',
19      retryAfter: res.getHeader('RateLimit-Reset'),
20    });
21  },
22});
23 
24// Stricter limit for auth endpoints — prevent brute force
25const authLimiter = rateLimit({
26  windowMs: 60 * 60 * 1000, // 1 hour
27  max: 10,                   // 10 login attempts per hour
28  skipSuccessfulRequests: true, // Only count failures
29});
30 
31// API key based limits (not just IP)
32function apiKeyLimiter(req: any, res: any, next: any) {
33  const key = req.headers['x-api-key'];
34  const limits = { free: 100, pro: 1000, enterprise: 10000 };
35  const tier = getTierForKey(key);
36  return rateLimit({ max: limits[tier], windowMs: 60 * 60 * 1000,
37    keyGenerator: () => key })(req, res, next);
38}
39 
40function getTierForKey(key: string): keyof typeof limits { return 'free'; }
41const limits = { free: 100, pro: 1000, enterprise: 10000 };
41 lines
Timeline — 4 Steps
Token Bucket
windowMs + max — fixed window rate limiting💡 Analogy
Like a tap with a limited daily flow — once the quota is used, you wait for next day's reset.
windowMs defines the time window (15 min). max defines max requests in that window. After max is hit, requests return 429 Too Many Requests.
Console Output
> Request: 99/100 in current window — OK
> Request: 100/100 — last allowed
> Request: 429 Too Many Requests
> RateLimit-Remaining: 0

Was this page helpful?

Discussion

windowMs + max — fixed window rate limiting

💡 Analogy

Like a tap with a limited daily flow — once the quota is used, you wait for next day's reset.

windowMs defines the time window (15 min). max defines max requests in that window. After max is hit, requests return 429 Too Many Requests.

Console Output

> Request: 99/100 in current window — OK
> Request: 100/100 — last allowed
> Request: 429 Too Many Requests
> RateLimit-Remaining: 0

windowMs + max — fixed window rate limiting

💡 Analogy

Like a tap with a limited daily flow — once the quota is used, you wait for next day's reset.

windowMs defines the time window (15 min). max defines max requests in that window. After max is hit, requests return 429 Too Many Requests.

Console Output

> Request: 99/100 in current window — OK
> Request: 100/100 — last allowed
> Request: 429 Too Many Requests
> RateLimit-Remaining: 0