Rate limiting

Memory, Redis, and identity-aware limits.

Rate limiting

Dhal supports rate limiting by IP, route, user ID, tenant ID, and API key ID.

{
  "rateLimit": {
    "enabled": true,
    "store": "memory",
    "keyBy": ["ip", "route"],
    "default": {
      "windowSeconds": 60,
      "max": 120
    }
  }
}

Route-level limit

{
  "routes": {
    "/api/login": {
      "rateLimit": {
        "windowSeconds": 60,
        "max": 5,
        "keyBy": ["ip", "route"]
      }
    }
  }
}

Identity-aware limit

{
  "identity": {
    "headers": {
      "tenantId": ["x-tenant-id"],
      "apiKeyId": ["x-api-key-id"]
    }
  },
  "routes": {
    "/api/private/*": {
      "rateLimit": {
        "windowSeconds": 60,
        "max": 60,
        "keyBy": ["tenantId", "apiKeyId", "route"]
      }
    }
  }
}

Production store

Use Redis or Valkey for multi-instance deployments.

import Redis from "ioredis";
import { createDhal } from "@rokadhq/dhal";
import { RedisRateLimitStore } from "@rokadhq/dhal/stores/redis";

const redis = new Redis(process.env.REDIS_URL);

const engine = createDhal({
  rateLimitStore: new RedisRateLimitStore(redis)
});