Rate Limiter

Restrict API request rates per client IP, return 429 responses with Retry-After headers, and share counters across clusters with Redis.

VitNode includes automated IP-based rate limiting middleware. Exceeding the request budget immediately returns 429 Too Many Requests with a Retry-After header, protecting authentication and public endpoints from brute-force attacks.

Quick start

Customize the rate limiter budget in apps/api/src/vitnode.api.config.ts:

apps/api/src/vitnode.api.config.ts

import { buildApiConfig } from "@vitnode/core/vitnode.config"

export const vitNodeApiConfig = buildApiConfig({
  rateLimiter: {
    points: 60, // Max requests allowed
    duration: 60, // Window in seconds
  },
})

The default configuration allows 80 requests per 60 seconds per IP address.

Disabled in development

Rate limiting is automatically bypassed when NODE_ENV=development to prevent interruptions during local coding.

429 Error Response Format

When a client exhausts their request allowance, the API returns a structured JSON error:

HTTP/1.1 429 Too Many Requests
Retry-After: 24
Content-Type: application/json

{
  "error": "Too Many Requests",
  "retryAfter": 24
}

Distributed Rate Limiting (Redis)

Without Redis: Counters are tracked in local memory per server instance.
With Redis: Counters are synchronized across all API containers using a distributed sliding window.

Configure Redis in vitnode.api.config.ts:

export const vitNodeApiConfig = buildApiConfig({
  redis: process.env.REDIS_URL
    ? { url: process.env.REDIS_URL, password: process.env.REDIS_PASSWORD }
    : undefined,
})

`rateLimiter` Options

Prop

Type

Learn More

Redis

Setup Redis for distributed caching and clustering

Captcha

Bot protection on sign-up and password reset forms