THE ENGINE BEHIND SUB-MS QUOTAS
Limiter.io sits at your edge network and executes rate evaluation globally in less than a millisecond. By utilizing co-located memory segments and precompiled Redis Lua scripts, we guarantee complete concurrency safety.
Tokens and quotas are partitioned using cryptographically isolated namespaces. Tenant metrics never bleed across boundaries, guaranteeing safety.
Algorithm scripts are pre-loaded in memory using SHA hashes. Evaluated directly in Redis to prevent state discrepancies and race conditions.
Failures are bypassed gracefully. The client SDK features automatic fail-open strategies, maintaining API availability if backend clusters undergo updates.
Token Bucket
ACTIVEMaintains a rolling counter of available tokens refilled at a constant rate. Supports instantaneous bursts without throttling.
RECOMMENDED FOR: Standard API endpoints, user login routes, payment gates.
local key = KEYS[1]
local limit = tonumber(ARGV[1])
local rate = tonumber(ARGV[2])
local now = tonumber(ARGV[3])Fixed Window
ACTIVEDivides time into static windows (e.g. 1 minute) and tracks absolute request counts within that period. Discards window count upon boundary overlap.
RECOMMENDED FOR: Daily scraping limits, monthly data sync boundaries.
local count = redis.call("INCR", key)
if count == 1 then
redis.call("EXPIRE", key, window)
endSliding Window Counter
ACTIVEUses a weighted average of the current and previous windows to compute the current rate, smoothing out boundary-crossing spikes.
RECOMMENDED FOR: High-traffic web hooks, global ingress protection.
local prev_count = redis.call("GET", prev_key) or 0
local curr_count = redis.call("GET", curr_key) or 0
local weight = (window_sec - elapsed) / window_secSliding Window Log
ACTIVELogs every individual request timestamp in a Redis sorted set (ZSET). Evicts timestamps older than the window, offering complete accuracy.
RECOMMENDED FOR: High-value financial transfers, sensitive auth validation.
redis.call("ZREMRANGEBYSCORE", key, 0, min_score)
local current_requests = redis.call("ZCARD", key)
redis.call("ZADD", key, now, request_id)Leaky Bucket
ACTIVEQueues requests in a buffer that drips at a constant rate, smoothing out bursty traffic and enforcing a steady, strict output flow.
RECOMMENDED FOR: External third-party API sync, batch process ingestion.
local last_update = redis.call("HGET", key, "last")
local water = redis.call("HGET", key, "water")
local leaked = (now - last_update) * drip_rate