api-rate-limiting-throttling-expert

license	Apache-2.0
name	api-rate-limiting-throttling-expert
description	Token bucket, sliding window, and Redis-based rate limiting for API protection. Activate on: rate limiting, throttling, token bucket, sliding window, API abuse, DDoS protection, quota management. NOT for: API gateway setup (use api-gateway-reverse-proxy-expert), caching (use cache-strategy-invalidation-expert).
allowed-tools	Read,Write,Edit,Bash(npm:*,npx:*,redis-cli:*)
category	Backend & Infrastructure
tags	["rate-limiting","throttling","redis","api-protection","token-bucket"]
pairs-with	[{"skill":"api-gateway-reverse-proxy-expert","reason":"Rate limiting is typically enforced at the gateway"},{"skill":"cache-strategy-invalidation-expert","reason":"Redis powers both caching and rate limit counters"},{"skill":"multi-tenant-architecture-expert","reason":"Per-tenant rate limits are essential for multi-tenant APIs"}]

API Rate Limiting & Throttling Expert

Implement fair, efficient rate limiting using token bucket, sliding window, and fixed window algorithms with Redis-backed distributed counters.

Activation Triggers

Activate on: "rate limiting", "throttling", "token bucket", "sliding window", "API abuse", "DDoS protection", "quota management", "429 Too Many Requests", "request limits"

NOT for: API gateway configuration → api-gateway-reverse-proxy-expert | Caching strategies → cache-strategy-invalidation-expert | WAF/firewall rules → relevant security skill

Quick Start

1. Define limits — requests/minute per API key, IP, or user tier
2. Choose algorithm — sliding window log (precise), token bucket (bursty), fixed window (simple)
3. Use Redis — atomic operations with MULTI/EXEC or Lua scripts for distributed rate limiting
4. Return proper headers — X-RateLimit-Limit, X-RateLimit-Remaining, Retry-After
5. Differentiate tiers — free/pro/enterprise get different limits

Core Capabilities

Domain	Technologies
Algorithms	Token bucket, sliding window log, sliding window counter, fixed window
Storage	Redis 7.4+, Valkey, DragonflyDB, in-memory (single node)
Libraries	rate-limiter-flexible, @upstash/ratelimit, express-rate-limit
Gateway Plugins	Kong rate-limiting, Nginx limit_req, Traefik ratelimit
Standards	RFC 6585 (429), RateLimit headers (draft-ietf-httpapi-ratelimit)

Architecture Patterns

Sliding Window Counter (Redis Lua)

-- Redis Lua script: sliding window rate limiter
-- KEYS[1] = rate limit key
-- ARGV[1] = window size (seconds)
-- ARGV[2] = max requests
-- ARGV[3] = current timestamp

local key = KEYS[]
 window = (ARGV[])
 limit = (ARGV[])
 now = (ARGV[])


redis.call(, key, , now - window)


 count = redis.call(, key)

 count < limit 
  redis.call(, key, now, now ..  .. .())
  redis.call(, key, window)
   {, limit - count - }  

   {, }