API Rate Limiter — Upstash Redis Sliding Window

True sliding-window rate limiting middleware for distributed Node.js and serverless APIs.

Production-ready sliding window rate limiter middleware powered by Upstash Redis sorted sets. Features burst tolerance, IPv4 CIDR subnet whitelisting, custom key extraction (API keys, user IDs), standard RFC headers (X-RateLimit-*), and fail-open resilience when Redis is unreachable. Dual Express & standalone API.

Key Capabilities & Architecture

True Sliding Window Algorithm

Uses Redis sorted sets (ZADD/ZREMRANGEBYSCORE/ZCARD) to eliminate boundary-spike vulnerabilities of fixed-window limiters.

Burst Tolerance Buffer

Allows a configurable burst allowance (e.g. 15%) above your threshold before hard 429 blocking occurs.

CIDR Subnet Whitelisting

Supports single IP addresses as well as CIDR notation blocks (e.g. 10.0.0.0/8, 192.168.1.0/24) for internal proxies and microservices.

Fail-Open Resilience

Gracefully allows requests to proceed if Redis experiences a network interruption, safeguarding uptime.

Quick Setup & Installation Instructions

npm install @upstash/redis dotenv
Add UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN to your .env
Import createRateLimiter from api-rate-limiter-redis
Apply to Express app: app.use(createRateLimiter({ windowMs: 60000, maxRequests: 100 }))

Verified Compatibility & Requirements

✓ Node.js 18+ LTS✓ Express 4+ / 5✓ Next.js Route Handlers✓ Upstash Serverless Redis (REST API)✓ Any Redis Server over REST

₹10

One-time purchase • Unlimited commercial use • Instant download

Instant ZIP package delivery after checkout

Encrypted token download link (active 48h)

Verified secure checkout via Razorpay

Full source code with zero obfuscation

🔒 256-bit encrypted transaction • Official QorelySofts digital license

Included in Your Download ZIP

└─src/rate-limiter.js
└─src/redis-client.js
└─src/utils.js
└─src/index.js
└─example/server.js
└─README.md
└─.env.example

Express Integration

javascript

const express = require('express');
const { createRateLimiter } = require('api-rate-limiter-redis');

const app = express();

const limiter = createRateLimiter({
  windowMs: 60 * 1000, // 1 minute
  maxRequests: 100,
  burstTolerance: 0.10, // 10% burst buffer
  whitelist: ['127.0.0.1', '10.0.0.0/8'],
  passOnError: true // Fail-open resilience
});

app.use('/api', limiter);

Frequently Asked Questions

Technical specifics and licensing details for this product.

Do I need self-hosted Redis?

No! It is natively configured for Upstash Serverless Redis over HTTP/REST, making it ideal for Vercel, AWS Lambda, Render, and standard Express.

Can I rate limit by API Key or User ID instead of IP?

Yes. Supply a custom keyGenerator function: (req) => req.headers["x-api-key"] || req.user.id.