api-rate-limiting

Use middleware that tracks requests per user or IP with token bucket or sliding window logic. The Skill provides Express middleware examples that set X-RateLimit-Limit and X-RateLimit-Remaining headers and return 429 when limits are exceeded.

Token bucket allows controlled bursts by refilling tokens at a steady rate, while sliding window enforces a strict request count over a moving time window. Choose token bucket for burst tolerance and sliding window for precise quota enforcement.

Use Redis sorted sets to store request timestamps per key, removing entries outside the window with zremrangebyscore and counting with zcard. This keeps limits consistent across multiple server instances, unlike in-memory storage.

Define a limits map per plan tier, look up the user's plan, and apply the corresponding request count and window. The tiered example returns an upgrade URL in the 429 response when free-tier users exceed their quota.

In-memory limiters reset on restart and do not share state across instances, so limits are inconsistent in load-balanced deployments. Use Redis-backed storage for production and include Retry-After headers so clients know when to retry.