Everything you need to keep your API yours.

01 - Limits

Limits that understand your plans

Define a policy per plan tier, per endpoint, or per individual API key. Burst allowances let a client spend ahead briefly and repay it, which is how real traffic behaves - batch jobs are bursty, and blocking them is not protection, it is an outage you caused.

• Fixed window, sliding window and token bucket strategies
• Per-key overrides applied in under five seconds
• Standard RateLimit-* response headers out of the box

03 - Control

Drop it in without a rewrite

Use the DNS proxy for zero code changes, or the middleware package if you want limits evaluated inside your own process. Same policy file either way.

// Express middleware
import { throttlebox } from "@throttlebox/express";

app.use(throttlebox({
  key: "api_key",
  policy: "public-api"
}));

# FastAPI middleware
from throttlebox import ThrottleBox

app.add_middleware(
    ThrottleBox,
    key="api_key",
    policy="public-api",
)

// net/http handler
tb := throttlebox.New(throttlebox.Config{
    Key:    "api_key",
    Policy: "public-api",
})

http.Handle("/v1/", tb.Wrap(apiHandler))