SecureLink

Rate limits

First-class rate limiting in @securelink/server for your SecureLink-protected APIs.

Cloudflare WAF rate limits are out of scope. SecureLink rate limits protect your APIs after auth/proof verification.

Dimensions

  • user / anonymous id
  • device
  • installation
  • ip
  • endpoint

Config

rateLimit: {
  enabled: true,
  user: { max: 100, windowMs: 60_000 },
  device: { max: 50, windowMs: 60_000 },
  ip: { max: 200, windowMs: 60_000 },
  endpoint: { max: 30, windowMs: 60_000 },
  // store: myRedisStore,
}

Set enabled: false to turn the engine off entirely.

When exceeded, verify() throws ProtocolError with code RATE_LIMITED (HTTP 429).

Custom store

Implement RateLimitStore:

interface RateLimitStore {
  increment(key: string, windowMs: number): Promise<number>;
  reset?(key: string): Promise<void>;
}

Default is an in-memory store (fine for single-node / examples).