API Rate Limiter Worker

Per-IP Rate Limiting at the Edge — Before Requests Hit Your Server

A Cloudflare Worker that enforces configurable rate limits using Cloudflare KV. Blocks abusive clients with proper 429 responses and Retry-After headers before traffic ever reaches your origin.

What's Included

• Cloudflare Worker with sliding-window rate limiting logic
• Per-IP request counting stored in Cloudflare KV with TTL
• Configurable time window (seconds) and request limit
• Proper 429 Too Many Requests responses with Retry-After header
• Optional allowlist for trusted IPs (bypass rate limiting)
• wrangler.toml with KV binding pre-configured
• README with deployment and tuning guide

How It Works

Each incoming request writes the client IP and timestamp to a KV key with a sliding TTL. If the number of requests from that IP within the time window exceeds your configured limit, the Worker returns a 429 response immediately — the request never proxies to your origin.

What You Get

• Edge-level protection for any API endpoint or route pattern
• Zero origin impact from abusive or runaway clients
• Correct Retry-After header so well-behaved clients back off automatically
• KV-backed state — rate limits persist across Worker instances globally
• No app changes, no middleware, no server restarts

Requirements

• Cloudflare account with Workers and KV enabled
• Wrangler CLI installed (npm install -g wrangler)