upstash-ratelimit

Upstash Ratelimit

Overview

@upstash/ratelimit implements distributed rate limiting on top of Upstash Redis. Because state lives in Redis, every instance of a serverless function or edge worker shares the same counters, which an in-memory limiter cannot do. It ships three algorithms (fixed window, sliding window, token bucket), per-identifier keys, optional in-memory blocking of already-limited identifiers, and optional analytics.

When to Use This Skill

• Use when the user needs to limit requests per IP, user, API key, or tenant

across multiple serverless instances or regions.

• Use when protecting login, signup, form, webhook, or LLM endpoints from

abuse and returning 429 Too Many Requests.

• Use when choosing between fixed window, sliding window, and token bucket.
• Do not use for client-side retry/backoff against a third-party API's limits;

see api-rate-limit-handler.

• Do not use for a single long-running process with no shared state; an

in-memory limiter is simpler there.

How It Works

Step 1: Install and configure

npm install @upstash/ratelimit @upstash/redis

Set UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN in the environment.

Step 2: Create the limiter once, outside the handler

import { Ratelimit } from "@upstash/ratelimit";
import { Redis } from "@upstash/redis";

export const ratelimit = new