Rate Limiting Strategies

RateLock provides 4 rate limiting strategies, each suited for different use cases.

Fixed Window

Counts requests in fixed time windows. Simple and memory-efficient.

Best for: General API rate limiting, when you don't need per-key windows.

import { fixedWindow } from '@ratelock/local'

const limiter = await fixedWindow({
    limit: 100,
    windowMs: 60_000, // 100 requests per minute
})

Sliding Window

Smooths out the boundary problem of fixed windows by tracking individual request timestamps.

Best for: When you need more accurate rate limiting without burst at window boundaries.

import { slidingWindow } from '@ratelock/local'

const limiter = await slidingWindow({
    limit: 100,
    windowMs: 60_000,
})

Token Bucket

Allows bursts up to a capacity, then refills tokens at a steady rate.

Best for: APIs that should allow occasional bursts but maintain a steady average rate.

import { tokenBucket } from '@ratelock/local'

const limiter = await tokenBucket({
    capacity: 10, // max burst size
    refillRate: 1, // 1 token per second
})

Individual Fixed Window

Like Fixed Window, but each identifier gets its own independent window that starts on first request.

Best for: Per-user rate limiting where each user's window should start when they first make a request.

import { individualFixedWindow } from '@ratelock/local'

const limiter = await individualFixedWindow({
    limit: 10,
    windowMs: 60_000,
})

Strategy Comparison

Choosing a Strategy

• Start with Fixed Window - it's the simplest and works for most cases
• Use Sliding Window if you notice bursts at window boundaries
• Use Token Bucket if you want to allow occasional bursts
• Use Individual Fixed Window if each user should have their own window start time