# Animir Node Rate Limiter Flexible Node Rate Limiter Flexible

> rate-limiter-flexible

- Skill: `tomevault-io/animir-node-rate-limiter-flexible-node-rate-limiter-flexible` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/animir-node-rate-limiter-flexible-node-rate-limiter-flexible`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/animir-node-rate-limiter-flexible-node-rate-limiter-flexible/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/animir-node-rate-limiter-flexible-node-rate-limiter-flexible

---


# rate-limiter-flexible

Harden application security against brute-force and DoS attacks.
Atomic and non-atomic counters and rate limiting tools for Node.js, Deno, and browsers (Memory limiter). Zero production dependencies. Enhanced fixed window algorithm. ISC license.

- **Install:** `npm i rate-limiter-flexible`
- **ESM:** `import { RateLimiterMemory } from "rate-limiter-flexible"`
- **CommonJS:** `const { RateLimiterMemory } = require("rate-limiter-flexible")`

## When to Use This Skill

- Configuring any `rate-limiter-flexible` limiter (options, API, store setup)
- Writing Express/Koa/Hapi rate limiting middleware
- Implementing login brute-force protection or DoS mitigation
- Choosing between store backends (Redis vs Memory vs Mongo vs etc.)
- Setting up insurance strategy, in-memory block strategy, or BurstyRateLimiter
- Understanding `RateLimiterRes` object and HTTP response headers

## Quick Reference

See `references/full-reference.md` for the complete guide covering:

- All options (common + store-specific) with defaults
- All API methods (`consume`, `get`, `set`, `block`, `delete`, `penalty`, `reward`, `deleteInMemoryBlockedAll`)
- `RateLimiterMemory` best-effort persistence via `dump()` / `restore()` (snapshot state for graceful restarts)
- All 15+ limiter types (Redis, Memory, Mongo, MySQL, PostgreSQL, DynamoDB, Memcached, Prisma, Drizzle, SQLite, Etcd, Valkey, Cluster, PM2)
- Composite limiters (BurstyRateLimiter, RateLimiterUnion, RateLimiterQueue)
- Wrappers (Black/White lists, Timeouts, AWS SDK v3)
- Code examples for every common pattern

## Essential Patterns at a Glance

### Basic Usage

```js
const { RateLimiterMemory } = require("rate-limiter-flexible");

const limiter = new RateLimiterMemory({
  points: 10,   // 10 requests
  duration: 1,  // per second
});

limiter.consume(req.ip)
  .then((res) => { /* allowed */ })
  .catch((res) => {
    if (res instanceof Error) { /* store error */ }
    else { /* rate limited — res is RateLimiterRes */ }
  });
```

### HTTP Response Headers

```js
const headers = {
  "Retry-After": rateLimiterRes.msBeforeNext / 1000,
  "X-RateLimit-Limit": opts.points,
  "X-RateLimit-Remaining": rateLimiterRes.remainingPoints,
  "X-RateLimit-Reset": Math.ceil((Date.now() + rateLimiterRes.msBeforeNext) / 1000)
};
```

### Key Defaults

| Option | Default | Notes |
|--------|---------|-------|
| `points` | **Required** | Max consumable over `duration` |
| `duration` | **Required** | Seconds before reset; `0` = never expire |
| `keyPrefix` | `'rlflx'` | Must be unique per limiter |
| `blockDuration` | `0` | Seconds to block after points exhausted |

## Links

- [Full Wiki](https://github.com/animir/node-rate-limiter-flexible/wiki)
- [Options](https://github.com/animir/node-rate-limiter-flexible/wiki/Options)
- [API Methods](https://github.com/animir/node-rate-limiter-flexible/wiki/API-methods)
- [Usage Examples](https://github.com/animir/node-rate-limiter-flexible/wiki/Overall-example)

---
> Source: [animir/node-rate-limiter-flexible](https://github.com/animir/node-rate-limiter-flexible) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-06-24 -->