upstash-ratelimit-js

Implements Redis-backed rate limiting in TypeScript using the Upstash Ratelimit SDK.

Updated Jul 30, 2026
One-click install
npx skills add https://github.com/ramizik/okta --skill upstash-ratelimit-js-ramizik
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: upstash-ratelimit-js
Source: https://github.com/ramizik/okta/tree/main/.agents/skills/upstash-ratelimit-js
Command: npx skills add https://github.com/ramizik/okta --skill upstash-ratelimit-js-ramizik

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires @upstash/ratelimit, @upstash/redis, and includes references (resource) components.

What problem does it solve? APIs and serverless endpoints need protection against abuse, traffic spikes, and runaway clients, but building distributed rate limiting from scratch is error-prone. This Skill provides guidance for configuring the Upstash Ratelimit TypeScript SDK so requests can be throttled consistently across regions with Redis as the backing store. ## Core Features & Use Cases - Multiple Algorithms: Choose between Fixed Window, Sliding Window, and Token Bucket limiters with documented trade-offs for accuracy, burst handling, and Redis command cost. - Protection & Analytics: Enable deny lists, automatic IP blocking from abuse feeds, and per-request analytics with dashboard visibility. - Cost & Operations Guidance: Understand exact Redis command counts per algorithm and feature to control latency and Upstash billing. - Use Case: A Next.js API route limits each user to 10 requests per 10 seconds using a sliding window limiter, blocks known abusive IPs automatically, and returns 429 responses with retry-after information when limits are exceeded. ## Quick Start Set up an Upstash Redis rate limiter in my TypeScript app that allows 10 requests per 10 seconds per user and rejects requests once the limit is exceeded.

Frequently Asked Questions about upstash-ratelimit-js

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add rate limiting to a TypeScript API with Upstash Redis?

Install @upstash/ratelimit and @upstash/redis, create a Redis client with your URL and token, then construct a Ratelimit instance with an algorithm like Ratelimit.slidingWindow(10, "10 s"). Call limiter.limit(identifier) per request and reject when success is false.

Which rate limiting algorithm should I use: fixed window, sliding window, or token bucket?

Fixed window is cheapest and fastest but allows boundary bursts. Sliding window smooths boundary behavior at higher Redis command cost. Token bucket refills tokens at a steady rate and supports controlled bursts, but is not available for multi-region setups.

Does Upstash Ratelimit work in serverless and edge runtimes?

Yes, but ephemeral caching only works if the limiter is created outside the handler so it persists across invocations. In edge runtimes, pass the pending promise from limit() to context.waitUntil so analytics and multi-region sync complete.

How do I block abusive IPs automatically with Upstash Ratelimit?

Set enableProtection: true and pass the request ip to limit(). The SDK checks an auto IP deny list aggregated from over 30 abuse sources, refreshed daily at 2 AM UTC, plus manual deny lists managed in the Upstash dashboard.

Why is my rate limiter making more Redis calls than expected?

Sliding window is the most expensive algorithm, using up to 5 commands per call. Deny lists add 2 commands, analytics adds 1, dynamic limits add 1, and multi-region multiplies writes by the number of read regions.

Can I change rate limits at runtime without redeploying?

Yes, enable dynamicLimits: true in the constructor, then call setDynamicLimit({ limit: 5 }) to override the limit or setDynamicLimit({ limit: false }) to remove it. This works only for single-region limiters, not multi-region.