AutoGineer
Generated banner for Upstash Ratelimit JS
Generated logo for Upstash Ratelimit JS

Upstash Ratelimit JS

UpstashOfficialCreated by Upstash

  • Skill
  • Tool integration
  • Software development
  • MIT
  • No issues found
Download ZIP

From the author

Rate limiting for serverless and edge apps with the @upstash/ratelimit TypeScript/JavaScript SDK backed by Upstash Redis. Use when adding a rate limiter or throttling to an API route, Next.js middleware, Vercel Edge, Cloudflare Workers, or any HTTP endpoint; returning 429 Too Many Requests; choosing between fixed window, sliding window, and token bucket algorithms; limiting per user, IP, API key, or tenant with prefixes and custom keys; protecting login, signup, form, or AI endpoints from abuse, bots, and brute force; using deny lists, ephemeral caching, analytics, timeouts, and multi-region rate limits; or estimating the Redis command cost of rate limiting. Also use when the user says rate limit, rate-limiting, throttle, quota, request limits, or traffic protection.
— the description by Upstash

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The upstash-ratelimit-js skill provides guidance and documentation for integrating the @upstash/ratelimit SDK into TypeScript and JavaScript applications. It supports various rate-limiting algorithms, including fixed window, sliding window, and token bucket, to help developers manage traffic, prevent abuse, and enforce quotas across serverless and edge environments like Vercel Edge and Cloudflare Workers.

What it does

  • Provides implementation patterns for rate limiting API routes and middleware.
  • Supports multiple algorithms including fixed window, sliding window, and token bucket.
  • Enables traffic control based on user IDs, IP addresses, API keys, or tenant identifiers.
  • Offers guidance on protecting endpoints like login, signup, and AI services from abuse.
  • Includes documentation on Redis command costs and operational considerations.
  • Facilitates the use of advanced features like deny lists, analytics, and multi-region configurations.

When to use it

  • When you need to implement request throttling or quotas for your HTTP endpoints.
  • When protecting sensitive endpoints from brute force or bot abuse.
  • When building serverless or edge applications that require stateful rate limiting.
  • When you need to choose between different rate-limiting algorithms for specific traffic patterns.
  • When you need to estimate the Redis command costs associated with your rate-limiting strategy.

Advantages

  • Native support for serverless and edge runtime environments.
  • Flexible configuration for custom keys and request prefixes.
  • Comprehensive documentation on algorithms and traffic protection patterns.
  • Integration with Upstash Redis for distributed state management.

Usage examples

“How do I implement a sliding window rate limit for a user in my Next.js API route?”
The agent provides a code snippet using the Ratelimit class with the slidingWindow algorithm, showing how to check the success boolean to determine if a request should be throttled.
“What are the differences between the available rate-limiting algorithms?”
The agent explains the behavior of fixed window, sliding window, and token bucket algorithms as described in the algorithms.md file.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/upstash/upstash-ratelimit-js/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip upstash-ratelimit-js.zip -d .agents/skills

Documentation by Upstash

Rate Limit TS SDK

Bundled docs and source

Before writing or debugging SDK code, check node_modules/@upstash/ratelimit/docs/ for bundled docs and node_modules/@upstash/ratelimit/src/ for readable TypeScript source. Read and search the relevant files when present; otherwise use the references in this skill.

Quick Start

  • Install the SDK and connect to Redis.

  • Create a rate limiter and apply it to incoming operations.

Example:

import { Ratelimit } from "@upstash/ratelimit";
import { Redis } from "@upstash/redis";

const redis = new Redis({ url: "<url>", token: "<token>" });
const limiter = new Ratelimit({ redis, limiter: Ratelimit.slidingWindow(5, "10s") });

const { success } = await limiter.limit("user-id");
if (!success) {
  // throttled
}

Other Skill Files

  • algorithms.md: Describes all available rate‑limiting algorithms and how they behave.

  • pricing-cost.md: Explains pricing, Redis cost implications, and operational considerations.

  • features.md: Lists SDK features such as prefixes, custom keys, and behavioral options.

  • methods-getting-started.md: Full method reference for the SDK's API and getting started guide.

  • traffic-protection.md: Guidance on applying rate limiting for traffic shaping, abuse prevention, and protection patterns.

Files

traffic-protection.md

Traffic Protection

This skill documents how to use deny lists and automatic IP protection in the Upstash Ratelimit TypeScript SDK. It explains configuration, behavior, caching, update patterns, and common pitfalls.

Deny Lists

Deny lists block requests based on IP, user agent, country, or identifier. Enable protection by setting enableProtection: true when creating your Ratelimit client.

Example usage:

const ratelimit = new Ratelimit({
  redis: Redis.fromEnv(),
  limiter: Ratelimit.slidingWindow(10, "10 s"),
  enableProtection: true,
  analytics: true,
});

const result = await ratelimit.limit("userId", {
  ip: "203.0.113.5",
  userAgent: "malicious-bot",
  country: "CN",
});

await result.pending; // analytics sync

if (!result.success && result.reason === "denyList") {
  console.log("Blocked value:", result.deniedValue);
}
Behavior & Pitfalls

  • Exact match only; pattern matching is not supported.

  • Denied values are cached for 1 minute to reduce Redis load. Removal from the deny list may take up to a minute to propagate.

  • Adding a value propagates instantly.

  • Dashboard manages all deny list entries; analytics can show aggregated blocks.

Auto IP Deny List

Automatically blocks IPs aggregated from >30 open‑source abuse lists (via GitHub's ipsum repository). Updates occur daily at 2 AM UTC.

Enable protection:

const ratelimit = new Ratelimit({
  redis: Redis.fromEnv(),
  limiter: Ratelimit.slidingWindow(10, "10 s"),
  enableProtection: true,
});

const { success, pending } = await ratelimit.limit("userId", { ip: "203.0.113.77" });
await pending; // ensures async sync completion
Update Flow

  • First call to limit after 2 AM UTC triggers asynchronous list refresh.

  • Request results are returned immediately; updates complete in the background.

  • Use the pending promise when accuracy depends on the sync.

Dashboard Integration

  • All auto‑blocked IPs appear in the "Denied" section.

  • Feature can be disabled from the Upstash Console without disabling standard deny lists.

Common Mistakes

  • Forgetting to pass ip, userAgent, or country to limit → protection does not apply.

  • Expecting pattern or CIDR matches; only exact strings are checked.

  • Confusing auto IP deny list with manual deny list entries; both operate independently.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Upstash
Publisher
Upstash (Official)
Source
upstash/skills · skills/upstash-ratelimit-js · commit 9f9e3e5
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Upstash or Upstash.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download upstash-ratelimit-js.zip