rate-limit

Wire rate limiting into your Next.js app using Upstash Redis sliding window. Reads the project first, applies IP-based limiting by default, user-based when auth is available.

Three things that silently break rate limiting

1. Wrong Redis key scope. Using just the IP address as the key means all routes share one counter. A user who hits /api/generate 50 times uses up the budget for /api/auth/login too. Always namespace keys: rate:generate:${ip} not rate:${ip}.
2. No fallback when Redis is down. If Upstash times out and you throw, the entire route fails. Rate limiting is best-effort — fail open (allow the request) when the store is unreachable, and log the failure.
3. Not returning Retry-After. Clients that hit a 429 without a Retry-After header will retry immediately, making the problem worse. Always include it.

Phase 1: Detect the Project

cat package.json | grep -E "next|@upstash|upstash"

• Next.js present? → proceed
• @upstash/ratelimit already installed? → skip Phase 2, go to Phase 3
• Auth provider? (Clerk, NextAuth, Supabase Auth) → determines whether user-based limiting is available

Phase 2: Install and Configure