Production-ready rate limiting library with adaptive penalties, Redis failover, state persistence, and comprehensive event system
Test Coverage
Passing Tests
Event Types
ESLint Errors
Automatically detect and penalize abusive behavior with dynamic token adjustment. Perfect for spam detection and graduated responses.
Bonus tokens for quality users and good behavior. Encourage engagement while maintaining security.
Temporary bans with automatic expiry. Ideal for failed login protection and security holds.
Insurance limiter automatically falls back to in-memory when Redis fails. Never lose uptime.
Save and restore bucket state for crash recovery. Zero downtime during restarts.
Comprehensive event system for monitoring: allowed, rateLimitExceeded, penalty, reward, blocked, unblocked, reset, and more.
Drop-in middleware for Express.js with per-IP, per-user, and global rate limiting patterns.
Full TypeScript definitions with IntelliSense support. Type-safe event listeners and middleware.
Direct token manipulation for admin overrides. Get, set, reset, consume, add, and remove tokens programmatically.
Test all features in action with our comprehensive demo application. See adaptive penalties, block duration, and event streaming in real-time!
Launch Demonpm install rate-limiter-core@betaconst { TokenBucket } = require('rate-limiter-core');
// Create a rate limiter: 100 requests, refill 10 per second
const bucket = new TokenBucket(100, 10);
// Check if request is allowed
if (bucket.allowRequest()) {
console.log('Request allowed!');
} else {
console.log('Rate limit exceeded');
}const express = require('express');
const { perIpRateLimit } = require('rate-limiter-core');
const app = express();
// Apply rate limiting to all routes
app.use(perIpRateLimit({
capacity: 100,
refillRate: 10
}));
app.get('/api/data', (req, res) => {
res.json({ message: 'Success!' });
});// Detect spam and apply penalty
if (isSpam(message)) {
bucket.penalty(5); // Remove 5 tokens
}
// Reward quality content
if (isQuality(message)) {
bucket.reward(2); // Add 2 bonus tokens
}Complete API documentation for all classes and methods
Express.js middleware integration and examples
Distributed rate limiting with Redis
Production deployment guide and optimization tips
Save/restore limiter state for crash recovery
Release notes and version history
Protect your API from spam, scrapers, and DDoS attacks. Maintain service quality for legitimate users.
Manage API costs and prevent bill shock. Essential for cloud services with usage-based pricing.
Prevent system overload and maintain response times. Fair resource distribution across all users.
We welcome contributions! Report issues, submit pull requests, or join discussions on GitHub.