Skip to content


Repository files navigation


tests npm version npm downloads license

Basic rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset. Plays nice with express-slow-down and ratelimit-header-parser.


The full documentation is available on-line.

import { rateLimit } from 'express-rate-limit'

const limiter = rateLimit({
	windowMs: 15 * 60 * 1000, // 15 minutes
	limit: 100, // Limit each IP to 100 requests per `window` (here, per 15 minutes).
	standardHeaders: 'draft-7', // draft-6: `RateLimit-*` headers; draft-7: combined `RateLimit` header
	legacyHeaders: false, // Disable the `X-RateLimit-*` headers.
	// store: ... , // Redis, Memcached, etc. See below.

// Apply the rate limiting middleware to all requests.

Data Stores

The rate limiter comes with a built-in memory store, and supports a variety of external data stores.


All function options may be async. Click the name for additional info and default values.

Option Type Remarks
windowMs number How long to remember requests for, in milliseconds.
limit number | function How many requests to allow.
message string | json | function Response to return after limit is reached.
statusCode number HTTP status code after limit is reached (default is 429).
handler function Function to run after limit is reached (overrides message and statusCode settings, if set).
legacyHeaders boolean Enable the X-Rate-Limit header.
standardHeaders 'draft-6' | 'draft-7' Enable the Ratelimit header.
store Store Use a custom store to share hit counts across multiple nodes.
keyGenerator function Identify users (defaults to IP address).
requestPropertyName string Add rate limit info to the req object.
skip function Return true to bypass the limiter for the given request.
skipSuccessfulRequests boolean Uncount 1xx/2xx/3xx responses.
skipFailedRequests boolean Uncount 4xx/5xx responses.
requestWasSuccessful function Used by skipSuccessfulRequests and skipFailedRequests.
validate boolean | object Enable or disable built-in validation checks.

Thank You

Sponsored by Zuplo a fully-managed API Gateway for developers. Add dynamic rate-limiting, authentication and more to any API in minutes. Learn more at


Thanks to Mintlify for hosting the documentation at

Create your docs today

Finally, thank you to everyone who's contributed to this project in any way! 🫶

Issues and Contributing

If you encounter a bug or want to see something added/changed, please go ahead and open an issue! If you need help with something, feel free to start a discussion!

If you wish to contribute to the library, thanks! First, please read the contributing guide. Then you can pick up any issue and fix/implement it!


MIT © Nathan Friedly, Vedant K