Rate limiting, minus the Redis.
Four algorithms, per-identifier overrides, quotas, blocklists, and analytics — behind one HTTP call. No Redis to operate, no Lua to maintain, no per-request metering.
import { createLimitClient } from '@brume/limit'
const limit = createLimitClient({
apiKey: proces...KEY,
})
export async function handler(req, res) {
const result = await limit.limit('api', req.user.id)
if (!result.success) {
res.setHeader('Retry-After', String(result.retry_after ?? 60))
return res.status(429).json({ error: 'Too many requests' })
}
return handle(req, res)
}Pick the right policy for the job.
Smooth traffic with optional burst capacity. Ideal for APIs that tolerate short spikes.
Simple per-window counter. Predictable reset times and minimal Redis overhead.
Exact request timestamps within the window. Strictest fairness, higher memory cost.
Approximate rolling rate with constant memory. Fast and accurate enough for most gates.
The surface your first hour needs.
Give one user, key, or IP its own limit without a second rule. The override shares the rule counter and inherits whatever you leave unset.
Monthly, weekly, and daily caps with billing-cycle-aware resets, enforced alongside the rate rule.
IP and key deny/allow lists evaluated before any rule runs. Blocked identifiers never consume capacity.
Allowed, denied, and remaining per namespace and identifier. Find the client hammering you without adding counters.
Evaluate several namespaces in one call. One round-trip instead of one per rule.
If Redis goes down, checks return success with degraded: true. Availability over correctness, and you can see it happened.
Free tier that competes. Pricing that doesn't jump.
| Service | Free tier | Algorithms | Pricing model |
|---|---|---|---|
| Brume Limit | 10,000 checks/day | All four | Flat rate |
| Unkey | 150K verifications/mo | Token + fixed | Step tiers |
| Upstash | ~100K checks/mo | Redis scripts | Per command |
Free-tier figures are public-plan estimates as of 2026-08-27. Check each vendor for current limits.
First check in five minutes.
Create a rule in the dashboard or the API, then call limit.limit from your backend. Free tier included, no credit card required.