Rate-limiting paid-API routes — Upstash, Cloudflare, edge-native

What it is

Rate limiting bounds requests per identity per time window. Edge-native (Cloudflare / Vercel Edge / Upstash) puts the limit before the expensive inference call.

Vulnerable example

// /api/chat/route.ts — no rate limit
export async function POST(req: Request) { /* expensive openai call */ }

Fixed example

import { Ratelimit } from "@upstash/ratelimit";
import { Redis } from "@upstash/redis";
const ratelimit = new Ratelimit({
  redis: Redis.fromEnv(),
  limiter: Ratelimit.slidingWindow(20, "1 m"), // 20/min per IP
});
export async function POST(req: Request) {
  const ip = req.headers.get("x-forwarded-for") ?? "anon";
  const { success } = await ratelimit.limit(ip);
  if (!success) return new Response("Too many requests", { status: 429 });
  // continue to expensive call
}

How Securie catches it

import { Ratelimit } from "@upstash/ratelimit";
import { Redis } from "@upstash/redis";
const ratelimit = new Ratelimit({
  redis: Redis.fromEnv(),
  limiter: Ratelimit.slidingWindow(20, "1 m"), // 20/min per IP
});
export async function POST(req: Request) {
  const ip = req.headers.get("x-forwarded-for") ?? "anon";
  const { success } = await ratelimit.limit(ip);
  if (!success) return new Response("Too many requests", { status: 429 });
  // continue to expensive call
}

Checklist

• Per-IP rate limit at edge
• Per-user rate limit (more restrictive)
• Per-tenant spend cap (cost-firewall)
• Vendor-side cap as backstop
• Monitoring alerts

FAQ

Related guides