Installation

RateLock is distributed as multiple npm packages. Install only the storage engine you need - each one includes all 4 rate limiting strategies.

Choose an Engine

In-Memory (zero dependencies)

Redis

Or with ioredis:

With Bun's native client

On Bun >= 1.4, no extra dependency is needed — the driver is auto-detected:

import { RedisClient } from 'bun'
import { fixedWindow } from '@ratelock/redis'

const limiter = await fixedWindow({
    client: new RedisClient('redis://localhost:6379'),
    limit: 100,
    windowMs: 60_000,
})

Or by URL with driver: 'bun'.

Upstash Redis (HTTP / Edge)

Use the official Upstash REST client when your runtime cannot open a Redis TCP connection:

Create the client with Redis.fromEnv() or pass an explicit { url, token } configuration to @upstash/redis, then give that client to the RateLock factory. Cloudflare Workers and Pages should import Redis from @upstash/redis/cloudflare and call Redis.fromEnv(env). See the Upstash engine guide for the full Edge example.

PostgreSQL

Or with pg:

Each engine includes all 4 strategies and built-in resilience policies.

Using Multiple Engines

You can use different engines for different rate limiters in the same app:

import { fixedWindow as localFixedWindow } from '@ratelock/local'
import { fixedWindow as redisFixedWindow } from '@ratelock/redis'

// Local engine for lightweight, in-memory checks
const localLimiter = await localFixedWindow({ limit: 100, windowMs: 60_000 })

// Redis engine for distributed, highly-available checks
const redisLimiter = await redisFixedWindow({
    url: 'redis://localhost:6379',
    limit: 1000,
    windowMs: 60_000,
})

Requirements

• Node.js 22+ or Bun 1.1+ for the Node/Bun packages
• TypeScript 5+ (recommended, not required)
• Redis 6+ (for @ratelock/redis)
• PostgreSQL 14+ (for @ratelock/postgres)
• An Upstash Redis database and REST credentials (for @ratelock/upstash)