Skip to content← All ComparisonsEdge rate limiting
Competitor familyBrume vs Cloudflare Rate Limiting
Cloudflare guards the edge. Brume limits inside your app.
Cloudflare rate limiting protects your perimeter with coarse, route-level rules. Application logic — per-user limits, quotas, overrides, allowlists keyed to your identifiers — lives above the edge. Brume and Cloudflare are complementary: Cloudflare stops the flood, Brume meters the traffic that gets through.
Cloudflare
Perimeter defense at the CDN layer — coarse by design.
Feature comparison.
| Feature | Brume | Cloudflare Rate Limiting |
|---|
| Layer | Application | Edge |
| Per-identifier logic | Any identifier | IP / route / headers |
| Per-identifier overrides | Built-in | No |
| Long-window quotas | Built-in | No |
| Block & allow lists | Keyed to your IDs | IP-based |
| Works outside Cloudflare | Yes | No |
| Positioning | Complements edge | Perimeter defense |
Migration
Migrating from Cloudflare Rate Limiting?
Read the migration guide or start building on the free tier.
This is the comparison where the honest answer is "use both." Cloudflare rate limiting and Brume Limit operate at different layers, and they are complementary rather than competitive.
The layer difference
Cloudflare rate limiting protects your perimeter: coarse, route-level rules keyed to IPs, paths, and headers, enforced at the edge before traffic reaches you. It is excellent at stopping floods.
Application logic lives above the edge. "This user gets 100 requests a minute, this paying customer gets 1,000, this partner gets a monthly budget of 10,000, and this identifier is blocked until we say otherwise" — none of that can be expressed at the perimeter, because the perimeter does not know who your users are.
That is Brume's layer: per-identifier limits keyed to your identifiers — user IDs, API keys, routes — evaluated inside your request path with one HTTP call.
Where each wins
| Situation | Right tool |
|---|
| A DDoS or credential-stuffing flood | Cloudflare (stop it at the edge) |
| Per-user API limits | Brume |
| Monthly budgets per customer | Brume (quotas) |
| VIP allowances | Brume (overrides) |
| Blocking a specific abusive account | Brume (blocklists, keyed to your IDs) |
| Coarse route throttling | Either — Cloudflare if you already run it |
What Brume adds over the edge
- Any identifier, not just IP/route/header.
- Per-identifier overrides, quotas, and blocklists keyed to your domain objects.
- Works outside Cloudflare — any host, any cloud, any runtime with HTTPS.
- Standard
X-RateLimit-* headers and a typed SDK for the verdict.
What Cloudflare has that Brume doesn't
- Edge presence in hundreds of cities. Brume runs from Frankfurt during soft launch.
- Perimeter-scale flood absorption. Brume is not a DDoS product; put Cloudflare (or any edge) in front of it.
The recommended stack
Cloudflare at the perimeter to stop the flood. Brume inside your application to meter the traffic that gets through. They do not overlap; they hand off.