A rate-limiting gateway — est. 2026
Limits shouldrun quiet.
Brume is a single Rust binary that sits in front of the stack you already run, answers one question per request — is this allowed? — and forgets every counter the moment its window closes.
Six invariants we don't negotiate.
These are not marketing claims. They are structural properties of the binary and the billing — each one points to something you can verify.
Brume never sees your database and never sits inside your framework. It is one HTTPS call from any runtime that has fetch — Node, Bun, Deno, edge functions. Your data and credentials stay where they belong.
A check carries a namespace, an identifier, and a cost. There is no payload to log, so there is no payload store. Not a configuration knob — a structural invariant. There is no verbose mode to leak.
Flat-rate per tier. No per-request metering, no overage invoices. Exceeding a cap rejects with PLAN_LIMIT — it never bills. The number on the invoice is the number you can plan around.
Every evaluation is one Lua script: blocklist, override, quota, and counter update in a single operation. No race windows, no double-counting, no app-side locking.
When Redis is down, the gateway fails open and tells you — degraded: true, with a header. Availability over correctness, made visible instead of silent. You choose your tradeoff in SDK config.
The SDK is the product. Two operations, one result type, an ephemeral cache for blocked identifiers, explicit timeout fallbacks. Build something this afternoon.
Built to
disappear.
Rate limiting should not be a project. It should be a line in your request path — a thing you forget exists and only notice the moment you remove it. Brume is a single Rust binary. It answers one question per call, never touches your database, and stores nothing it does not need to answer.
The best rate limiter is the one you stop thinking about by week two.
The SDK is one small package: two operations, one result type, an ephemeral cache, and explicit failure fallbacks. The pricing is flat, the architecture is plain, and the API is documented in one OpenAPI file. If you can read a README and make an HTTPS call, you can ship rate limiting this afternoon.
Get in touch
Built by developers
who were tired of
writing limiters.
Brume is the rate limiter we wished existed. If you're building with it, integrating it, or trying to break it — we want to hear from you.