Api Rate Limiting

This covers the three main rate limiting algorithms you'll actually use: token bucket for smooth traffic shaping, sliding window for precision, and fixed window when you need something simple. The reference guides include Redis implementations, which is what you want for any production system that runs on multiple servers. It also handles the tiered limits scenario, so you can give paying customers higher quotas. The code examples are JavaScript and Python/Flask, and it reminds you to include the standard rate limit headers in responses. One thing to know: the best practices correctly warn against in-memory storage in production, but the quick start example is in-memory, so you'll need to jump to the Redis guide for real deployments.

skills.sh installs: 647
GitHub stars: 379
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add aj-geddes/useful-ai-prompts --skill api-rate-limiting --agent claude-code

Installs into .claude/skills of the current project.

Files

Overview

Protect APIs from abuse and manage traffic using various rate limiting algorithms with per-user, per-IP, and per-endpoint strategies.

When to Use

Protecting APIs from brute force attacks
Managing traffic spikes
Implementing tiered service plans
Preventing DoS attacks
Fairness in resource allocation
Enforcing quotas and usage limits

Quick Start

Minimal working example:

// Token Bucket Rate Limiter
class TokenBucket {
  constructor(capacity, refillRate) {
    this.capacity = capacity;
    this.tokens = capacity;
    this.refillRate = refillRate; // tokens per second
    this.lastRefillTime = Date.now();
  }

  refill() {
    const now = Date.now();
    const timePassed = (now - this.lastRefillTime) / 1000;
    const tokensToAdd = timePassed * this.refillRate;

    this.tokens = Math.min(this.capacity, this.tokens + tokensToAdd);
    this.lastRefillTime = now;
  }

  consume(tokens = 1) {
    this.refill();

SKILL.md on GitHub