bext-plugin-rate-limit

Distributed rate limiting with sliding window. Redis optional.

Sliding window algorithm for accurate request counting. When Redis is configured, state is shared across all bext instances for true distributed limiting. Falls back to in-memory when Redis is unavailable.

Install

bext plugin add rate-limit

Config

[plugins.rate-limit]
window = "60s"
max_requests = 100
burst = 20
redis_url = "$REDIS_URL"  # optional

Keying strategies

By default, limits are per-IP. You can change this with the `key` option:

key = "ip"           # default — per client IP
key = "header:x-api-key"  # per API key
key = "auth:user_id"      # per authenticated user (requires auth-jwt)

Response headers

Every response includes rate limit headers:

• `X-RateLimit-Limit` — max requests per window
• `X-RateLimit-Remaining` — requests left in current window
• `X-RateLimit-Reset` — seconds until window resets

When the limit is exceeded, the plugin returns 429 with a `Retry-After` header.

Burst allowance

The `burst` setting lets clients exceed the base rate temporarily. A burst of 20 with a limit of 100/min means a client can send up to 120 requests in a short spike, but the average over the window must stay under 100.