API速率限制完全指南：算法、实现与最佳实践，保护API免受滥用

api-rate-limiting by aj-geddes/useful-ai-prompts

223 周安装量

157 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/aj-geddes/useful-ai-prompts --skill api-rate-limiting

性能优化 API 安全

🇨🇳中文介绍

API 速率限制

概述

使用多种速率限制算法，通过按用户、按 IP 和按端点的策略来保护 API 免受滥用并管理流量。

使用场景

保护 API 免受暴力攻击
管理流量高峰
实施分层服务计划
防止 DoS 攻击
确保资源分配的公平性
强制执行配额和使用限制

快速开始

最小工作示例：

// Token Bucket Rate Limiter
class TokenBucket {
  constructor(capacity, refillRate) {
    this.capacity = capacity;
    this.tokens = capacity;
    this.refillRate = refillRate; // tokens per second
    this.lastRefillTime = Date.now();
  }

  refill() {
    const now = Date.now();
    const timePassed = (now - this.lastRefillTime) / 1000;
    const tokensToAdd = timePassed * this.refillRate;

    this.tokens = Math.min(this.capacity, this.tokens + tokensToAdd);
    this.lastRefillTime = now;
  }

  consume(tokens = 1) {
    this.refill();

    if (this.tokens >= tokens) {
      this.tokens -= tokens;
      return true;
    }
// ... (see reference guides for full implementation)

参考指南

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

指南	内容
令牌桶算法	Token Bucket Algorithm
滑动窗口算法	Sliding Window Algorithm
基于 Redis 的速率限制	Redis-Based Rate Limiting
分层速率限制	Tiered Rate Limiting
Python 速率限制 (Flask)	Python Rate Limiting (Flask)
响应头	Response Headers

🇺🇸English

API Rate Limiting

Overview
When to Use
Quick Start
Reference Guides
Best Practices

Overview

Protect APIs from abuse and manage traffic using various rate limiting algorithms with per-user, per-IP, and per-endpoint strategies.

When to Use

Protecting APIs from brute force attacks
Managing traffic spikes
Implementing tiered service plans
Preventing DoS attacks
Fairness in resource allocation
Enforcing quotas and usage limits

Quick Start

Minimal working example:

// Token Bucket Rate Limiter
class TokenBucket {
  constructor(capacity, refillRate) {
    this.capacity = capacity;
    this.tokens = capacity;
    this.refillRate = refillRate; // tokens per second
    this.lastRefillTime = Date.now();
  }

  refill() {
    const now = Date.now();
    const timePassed = (now - this.lastRefillTime) / 1000;
    const tokensToAdd = timePassed * this.refillRate;

    this.tokens = Math.min(this.capacity, this.tokens + tokensToAdd);
    this.lastRefillTime = now;
  }

  consume(tokens = 1) {
    this.refill();

    if (this.tokens >= tokens) {
      this.tokens -= tokens;
      return true;
    }
// ... (see reference guides for full implementation)

Reference Guides

Detailed implementations in the references/ directory:

Guide	Contents
Token Bucket Algorithm	Token Bucket Algorithm
Sliding Window Algorithm	Sliding Window Algorithm
Redis-Based Rate Limiting	Redis-Based Rate Limiting
Tiered Rate Limiting	Tiered Rate Limiting
Python Rate Limiting (Flask)	Python Rate Limiting (Flask)
Response Headers	Response Headers

Best Practices

✅ DO

Include rate limit headers in responses
Use Redis for distributed rate limiting
Implement tiered limits for different user plans
Set appropriate window sizes and limits
Monitor rate limit metrics
Provide clear retry guidance
Document rate limits in API docs
Test under high load

❌ DON'T

Use in-memory storage in production
Set limits too restrictively
Forget to include Retry-After header
Ignore distributed scenarios
Make rate limits public (security)
Use simple counters for distributed systems
Forget cleanup of old data

Weekly Installs

168

Repository

aj-geddes/usefu…-prompts

GitHub Stars

126

First Seen

Jan 21, 2026

Security Audits

Gen Agent Trust HubPass SocketPass SnykPass

Installed on

opencode145

gemini-cli140

codex138

cursor124

claude-code122

github-copilot120