Api Rate Limiting

This gives you three rate limiting strategies to keep your API from getting hammered. The token bucket implementation handles traffic bursts gracefully, while the Express middleware example gets you running in minutes with configurable windows and request caps. Nice touch including the standard response headers and tiered limits table, since you'll need those for any production setup. The Redis mention is important but light on details, so you'll want to look up a distributed implementation if you're running multiple servers. Solid reference for the fundamentals, though the sliding window algorithm only gets a table entry without actual code.

skills.sh installs: 507
GitHub stars: 248
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add secondsky/claude-skills --skill api-rate-limiting --agent claude-code

Installs into .claude/skills of the current project.

Files

API Rate Limiting

Protect APIs from abuse using rate limiting algorithms with per-user and per-endpoint strategies.

Algorithms

Algorithm	Pros	Cons
Token Bucket	Handles bursts, smooth	Memory per user
Sliding Window	Accurate	Memory intensive
Fixed Window	Simple	Boundary spikes

Token Bucket (Node.js)

class TokenBucket {
  constructor(capacity, refillRate) {
    this.capacity = capacity;
    this.tokens = capacity;
    this.refillRate = refillRate; // tokens per second
    this.lastRefill = Date.now();
  }

  consume() {
    this.refill();
    if (this.tokens >= 1) {
      this.tokens--;
      return true;
    }
    return false;
  }

  refill() {
    const now = Date.now();
    const elapsed = (now - this.lastRefill) / 1000;
    this.tokens = Math.min(this.capacity, this.tokens + elapsed * this.refillRate);
    this.lastRefill = now;
  }
}

Express Middleware

const rateLimit = require('express-rate-limit');

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100,
  standardHeaders: true,
  message: { error: 'Too many requests, try again later' }
});

SKILL.md on GitHub