# API Rate Limiter

> Skill: api-rate-limiter

- Skill: `gabrielmoreira/api-rate-limiter` (Agent Skill)
- Install (CLI): `npx skillmds@latest add gabrielmoreira/api-rate-limiter`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gabrielmoreira/api-rate-limiter/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: gabrielmoreira (https://skillmd.com/u/gabrielmoreira)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/gabrielmoreira/api-rate-limiter

---


# Skill: api-rate-limiter

Provides a rate limiting middleware pattern for Next.js API routes and Server Actions.
Uses Upstash Redis (serverless-compatible) with sliding window algorithm.

## When to use
- Any public-facing API route
- Auth endpoints (login, signup, password reset) — most critical
- Any endpoint that triggers expensive operations (email, payment, AI inference)

## Files
- `rate-limiter.template.ts` — Rate limiter middleware

## Setup
1. Install: `pnpm add @upstash/ratelimit @upstash/redis`
2. Add to `.env.example`:
   ```
   UPSTASH_REDIS_REST_URL=   # Upstash Redis REST URL
   UPSTASH_REDIS_REST_TOKEN= # Upstash Redis REST token
   ```
3. Import and use in route handlers following the `route-handler-template.ts` pattern.

## Limits (starting point — tune to your traffic)
- Auth endpoints: 5 requests / 15 minutes per IP
- General API: 60 requests / minute per IP or user ID
- AI/expensive endpoints: 10 requests / hour per user