---
name: "rate-limiting-token-bucket-redis"
description: "Protect APIs against credential stuffing, brute force, and DoS using Redis rate limiters."
metadata:
  author: "Upstash"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "implement redis rate limiting"
  - "sliding window rate limiter"
  - "prevent brute force login"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Distributed Rate Limiting with Redis Token Bucket

Implements distributed rate limiting algorithms (Token Bucket, Sliding Window Counter) in Redis: tracking request quotas per IP and API token, emitting 429 Too Many Requests, and Retry-After headers.

## When to Invoke
Invoke this skill whenever you need to:
- implement redis rate limiting
- sliding window rate limiter
- prevent brute force login

## Execution SOP & Rules
1. Use atomic Redis multi/exec or Lua scripts to prevent concurrency race conditions.
2. Apply sliding window counter algorithms to prevent burst traffic spikes at window boundaries.
3. Include standard rate limit response headers (X-RateLimit-Limit, X-RateLimit-Remaining).
4. Whitelist trusted internal microservice IP addresses and health check probes.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.