mcpField
A
api-rate-limiting

api-rate-limiting

github.com/secondskySecurity240497 installsUpdated 5w ago
Repository

About api-rate-limiting

A rate-limiting guide for API developers, covering per-user and per-endpoint strategies. It demonstrates several algorithms, Express middleware, and response header handling.

Key features

  1. 01Token bucket, sliding window, and fixed window algorithms
  2. 02Express rate-limiting middleware example
  3. 03Rate-limit response header guidance
  4. 04Tiered request limit strategies
  5. 05Distributed rate-limiting practices

Use cases

  1. 01Limit API request rates per user
  2. 02Set quotas for different API endpoints
  3. 03Add standard headers to rate-limited responses
  4. 04Configure request caps for subscription tiers

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/secondsky/claude-skills --skill api-rate-limiting

After installing, type/api-rate-limitingin Claude Code to confirm it loaded.

Details

From the project README

API Rate Limiting

Protect APIs from abuse using rate limiting algorithms with per-user and per-endpoint strategies.

Algorithms

AlgorithmProsCons
Token BucketHandles bursts, smoothMemory per user
Sliding WindowAccurateMemory intensive
Fixed WindowSimpleBoundary spikes

Token Bucket (Node.js)

class TokenBucket {
  constructor(capacity, refillRate) {
    this.capacity = capacity;
    this.tokens = capacity;
    this.refillRate = refillRate; // tokens per second
    this.lastRefill = Date.now();
  }

  consume() {
    this.refill();
    if (this.tokens >= 1) {
      this.tokens--;
      return true;
    }
    return false;
  }

  refill() {
    const now = Date.now();
    const elapsed = (now - this.lastRefill) / 1000;
    this.tokens = Math.min(this.capacity, this.tokens + elapsed * this.refillRate);
    this.lastRefill = now;
  }
}

Express Middleware

const rateLimit = require('express-rate-limit');

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100,
  standardHeaders: true,
  message: { error: 'Too many requests, try again later' }
});

app.use('/api/', limiter);

Response Headers

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 45
X-RateLimit-Reset: 1705320000
Retry-After: 60

Tiered Limits

TierRequests/Hour
Free100
Pro1,000
Enterprise10,000

Best Practices

  • Use Redis for distributed rate limiting
  • Include proper headers in responses
  • Return 429 status with Retry-After
  • Implement tiered limits for different plans
  • Monitor rate limit metrics
  • Test under load

Comments

Markdown supported