| name | backend-rate-limit |
| description | Use when a public endpoint needs abuse protection: protect public endpoints with a token bucket rate limiter keyed by client identity. |
| slipstream | {"category":"backend","requires":["backend-hono-api"],"verification":{"kind":"test","description":"Rate limit tests pass.","command":"pnpm --dir {{apiDir}} test"},"tags":["api","security"]} |
Overview
Protect public endpoints with a token bucket rate limiter keyed by client identity.
Steps
- Implement a token bucket keyed by API key or IP address.
- Return
429 with a Retry-After header when the bucket is empty.
- Exempt the health endpoint from limiting.
Verify
Run the tests, then fire requests past the limit and confirm a 429 with Retry-After is returned.