Rate Limiting

Protect your procedures from abuse by limiting the number of calls from a specific user, IP, or key.

The rate limiting policy uses the cache adapter configured in createProcedure to store and check request logs.

[!NOTE] Production Scaling: While rate limiting works out-of-the-box using the default in-memory cache, it is highly recommended to configure a Redis Cache Adapter in multi-server or load-balanced production environments to ensure rate limit states are synchronized globally.

const sendMessage = procedure
  .input(
    zodResolver(
      z.object({ recipientId: z.string(), message: z.string() }),
    ),
  )
  .rateLimit({
    limit: 10,
    window: "1m",
    key: ({ ctx, input }) => `${ctx.userId}:${input.recipientId}`,
  })
  .mutation(async ({ input }) => {
    // ...
  });

Rate Limiting Options

Default Key Strategy

If no custom key generator function is defined, Actyx RPC automatically resolves the rate limit identity using the first available property in this order:

1. ctx.id
2. ctx.userId
3. ctx.ip
4. "anonymous" (failsafe)