Agent skill · software engineering · jeremylongshore
rate-limiting-apis
Implement sophisticated rate limiting with sliding windows, token buckets,
Why this skill is useful
Adds executable middleware scripts for sophisticated rate limiting with Redis integration that aren't in public docs.
What it needs
Requires bucket4j, rate-limiter-flexible, redis, slowapi installed locally. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Rate Limiting APIs Overview Implement sophisticated rate limiting using sliding window, token bucket, and fixed window counter algorithms with Redis-backed distributed state. Configure per-endpoint, per-user, and per-API-key limits with tiered quotas, burst allowances, and standard response headers that communicate limit status to API consumers. Prerequisites Redis 6+ for distributed rate limit state (required for multi-instance deployments) Rate limiting library: rate-limiter-flexible (Node.js), slowapi (Python/FastAPI), or Bucket4j (Java) API key or user identification mechanism for per-consumer tracking Monitoring for rate limit hit rates and rejected request metrics Documentation system for publishing rate limit policies to API consumers Instructions 1. Analyze endpoint traffic patterns using Read and Grep on access logs or metrics to determine appropriate rate limits per endpoint category (read-heavy, write-heavy, resource-intensive). 2. Select the rate limiting algorithm per endpoint: token bucket for bursty traffic allowance, sliding window log for precise per-second limits, or fixed window counter for simple quota enforcement. 3. Implement rate limiting middleware that extracts the client identifier (API key from header, user ID from JWT, or IP address as fallback) and checks against the configured limit. 4. Configure tiered rate limits per API consumer plan: Free (100 req/min), Pro (1000 req/min), Enterprise (10000 req/min) with per-endpoint overrides for expensive operations. 5. Add burst allowance using token bucket: allow 2x the sustained rate for 10 seconds to handle legitimate traffic spikes without penalizing well-behaved clients. 6. Set standard rate limit response headers on every response: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset (Unix timestamp), and RateLimit-Policy (draft IETF standard). 7. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/rate-limiting-apis