How do you implement rate limiting in a Node.js API?

Summary

Use middleware (express-rate-limit, @fastify/rate-limit) backed by Redis for multi-instance deployments, with algorithms like fixed window, sliding window or token bucket, keyed by API key, user ID or client IP, and return 429 with Retry-After.

Longer Answer

Configure trust proxy correctly so req.ip is the real client IP behind load balancers. Apply stricter limits to auth endpoints, and add edge rate limiting (CDN/WAF) for volumetric attacks.

Key Points

• Redis-backed shared limits
• Key by user/API key/IP
• trust proxy for real IPs
• 429 + Retry-After