Quickstart

Install

npm install limix

Create a limiter

import {
  Algorithms,
  createRateLimiter,
  MemoryStore,
} from 'limix';

export const limiter = createRateLimiter({
  algorithm: Algorithms.FIXED_WINDOW,
  limit: 100,
  windowMs: 60_000,
  store: new MemoryStore(),
});

Use new MemoryStore() rather than relying on a shared default instance — it keeps state ownership explicit, especially once you have more than one limiter in the same process.

Consume capacity

Call consume() with the identifier whose traffic you want to control. That could be a user ID, API key, tenant ID, or a carefully derived IP address.

const result = await limiter.consume('tenant_acme');

console.log(result);
// { allowed: true, remaining: 99, resetAt: 1760000000000, retryAfterMs: 0 }

retryAfterMs is 0 whenever allowed is true, and set to the number of milliseconds until the request would succeed whenever it’s false.

Handle the result

The core package does not send HTTP responses for you:

if (!result.allowed) {
  response.setHeader('Retry-After', String(Math.ceil(result.retryAfterMs / 1000)));
  response.status(429).json({ message: 'Too many requests' });
  return;
}

Next, compare the available algorithms or connect a Redis store.