New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Rate Limiting APIs

by jeremylongshore in jeremylongshore/tons-of-skills-marketplace

Implement sophisticated rate limiting with sliding windows, token buckets, and quotas.

MITAuto-check passedBackend & APIs

Install Rate Limiting APIs

skills CLI
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill rate-limiting-apis -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install jeremylongshore/tons-of-skills-marketplace rate-limiting-apis --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/.curated/rate-limiting-apis .claude/skills/rate-limiting-apis && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
rate-limiting-apis
GitHub stars
2.8k
Token cost
~1.4k tokens
SKILL.md length
617 words
Files
4 (incl. references)
Skills in repo
3,342
Repo updated
First seen
Licence
MIT

At a glance

Implement sophisticated rate limiting with sliding windows, token buckets, and quotas.

  • Works in 9 steps: Analyze endpoint traffic patterns using… → Select the rate limiting algorithm per… → Implement rate limiting middleware that… → …
  • Protecting APIs from excessive requests
  • SKILL.md covers Overview, Prerequisites, Instructions and Output, plus 3 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Rate Limiting APIs is an agent skill from jeremylongshore/tons-of-skills-marketplace. Implement sophisticated rate limiting with sliding windows, token buckets, and quotas. Use when protecting APIs from excessive requests. Trigger with phrases like "add rate limiting", "limit API requests", or "implement rate limits".

Its SKILL.md is about 1.4k tokens, which your agent loads only when the skill is triggered. The skill folder holds 4 other files, including reference files (for example `references/errors.md`, `references/examples.md` and `references/implementation.md`). Compatibility notes: Designed for Claude Code

It sits in Backend & APIs, covering Rate limiting. The repository describes itself as: Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com. The licence is MIT.

When your agent uses it

  • Protecting APIs from excessive requests
  • With phrases like add rate limiting
  • Limit API requests
  • Implement rate limits

Example prompts

  • “add rate limiting”
  • “limit API requests”
  • “implement rate limits”
  • “/rate-limiting-apis”

Requirements

  • Node.js
  • Compatibility (from SKILL.md): Designed for Claude Code
  • Pre-approved tools (allowed-tools): Read, Write, Edit, Grep, Glob, Bash(api:ratelimit-*)

Workflow steps

9 steps, taken from the first numbered list in SKILL.md.

  1. Analyze endpoint traffic patterns using Read and Grep on access logs or metrics to determine appropriate rate limits per endpoint category…
  2. Select the rate limiting algorithm per endpoint: token bucket for bursty traffic allowance, sliding window log for precise per-second…
  3. Implement rate limiting middleware that extracts the client identifier (API key from header, user ID from JWT, or IP address as fallback)…
  4. Configure tiered rate limits per API consumer plan: Free (100 req/min), Pro (1000 req/min), Enterprise (10000 req/min) with per-endpoint…
  5. Add burst allowance using token bucket: allow 2x the sustained rate for 10 seconds to handle legitimate traffic spikes without penalizing…
  6. Set standard rate limit response headers on every response: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset (Unix timestamp)…
  7. Return 429 Too Many Requests with Retry-After header (seconds until next allowed request) and a JSON body explaining the limit, current…
  8. Implement rate limit bypass for internal service-to-service calls using shared secret or mutual TLS identification to prevent internal…
  9. Write tests that verify rate limits engage at exact thresholds, headers reflect correct remaining counts, and limits reset at the…

What it can do on your machine

Read from SKILL.md and the folder at commit cfae287. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Read
    • Write
    • Edit
    • Grep
    • Glob
    • Bash(api:ratelimit-*)

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • datatracker.ietf.org
    • github.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

  • Compatibility

    Designed for Claude Code

    From compatibility in the SKILL.md frontmatter.

Context cost

Rate Limiting APIs loads about 1.4k tokens when it runs, and up to ~3.4k if it reads all its reference files. Until then it costs about 63 tokens; SKILL.md has 617 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~63
When it runs · the whole SKILL.md, loaded when a task matches
~1.4k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~3.4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from jeremylongshore/tons-of-skills-marketplace at commit cfae287, republished under its MIT licence (© jeremylongshore). 617 words, ~1,424 tokens.

Download SKILL.mdSave it as .claude/skills/rate-limiting-apis/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.
name
rate-limiting-apis
description
Implement sophisticated rate limiting with sliding windows, token buckets, and quotas. Use when protecting APIs from excessive requests. Trigger with phrases like "add rate limiting", "limit API requests", or "implement rate limits".
allowed-tools
Read, Write, Edit, Grep, Glob, Bash(api:ratelimit-*)
compatibility
Designed for Claude Code
version
1.25.0
author
Jeremy Longshore <jeremy@intentsolutions.io>
license
MIT
tags
api, rate-limiting

Rate Limiting APIs

Overview

Implement sophisticated rate limiting using sliding window, token bucket, and fixed window counter algorithms with Redis-backed distributed state. Configure per-endpoint, per-user, and per-API-key limits with tiered quotas, burst allowances, and standard response headers that communicate limit status to API consumers.

Prerequisites

  • Redis 6+ for distributed rate limit state (required for multi-instance deployments)
  • Rate limiting library: rate-limiter-flexible (Node.js), slowapi (Python/FastAPI), or Bucket4j (Java)
  • API key or user identification mechanism for per-consumer tracking
  • Monitoring for rate limit hit rates and rejected request metrics
  • Documentation system for publishing rate limit policies to API consumers

Instructions

  1. Analyze endpoint traffic patterns using Read and Grep on access logs or metrics to determine appropriate rate limits per endpoint category (read-heavy, write-heavy, resource-intensive).
  2. Select the rate limiting algorithm per endpoint: token bucket for bursty traffic allowance, sliding window log for precise per-second limits, or fixed window counter for simple quota enforcement.
  3. Implement rate limiting middleware that extracts the client identifier (API key from header, user ID from JWT, or IP address as fallback) and checks against the configured limit.
  4. Configure tiered rate limits per API consumer plan: Free (100 req/min), Pro (1000 req/min), Enterprise (10000 req/min) with per-endpoint overrides for expensive operations.
  5. Add burst allowance using token bucket: allow 2x the sustained rate for 10 seconds to handle legitimate traffic spikes without penalizing well-behaved clients.
  6. Set standard rate limit response headers on every response: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset (Unix timestamp), and RateLimit-Policy (draft IETF standard).
  7. Return 429 Too Many Requests with Retry-After header (seconds until next allowed request) and a JSON body explaining the limit, current usage, and reset time.
  8. Implement rate limit bypass for internal service-to-service calls using shared secret or mutual TLS identification to prevent internal traffic from consuming consumer quotas.
  9. Write tests that verify rate limits engage at exact thresholds, headers reflect correct remaining counts, and limits reset at the configured window boundary.

See ${CLAUDE_SKILL_DIR}/references/implementation.md for the full implementation guide.

Output

  • ${CLAUDE_SKILL_DIR}/src/middleware/rate-limiter.js - Rate limiting middleware with algorithm selection
  • ${CLAUDE_SKILL_DIR}/src/config/rate-limits.js - Per-endpoint and per-tier rate limit configuration
  • ${CLAUDE_SKILL_DIR}/src/utils/rate-limit-store.js - Redis-backed distributed counter implementation
  • ${CLAUDE_SKILL_DIR}/src/middleware/rate-limit-headers.js - Standard rate limit response header injection
  • ${CLAUDE_SKILL_DIR}/tests/rate-limiting/ - Rate limit threshold verification tests
  • ${CLAUDE_SKILL_DIR}/docs/rate-limits.md - Consumer-facing rate limit documentation
Show full SKILL.md (251 more words)Show less

Error Handling

ErrorCauseSolution
429 Too Many RequestsClient exceeded configured rate limit for the endpointReturn Retry-After header with seconds until reset; include limit details in JSON body
Redis connection failureRate limit state store unavailableFail open (allow requests) or fail closed (reject all) based on security posture; alert immediately
Clock skew between instancesDistributed rate limit windows misaligned across serversUse Redis server time (TIME command) as canonical clock; avoid relying on application server clocks
Inconsistent countsRace condition in read-check-increment cycleUse Redis MULTI/EXEC transaction or Lua script for atomic increment-and-check operations
Bypass abuseInternal bypass mechanism exploited by external clientValidate bypass credentials per-request; restrict bypass to specific IP ranges or mTLS certificates

Refer to ${CLAUDE_SKILL_DIR}/references/errors.md for comprehensive error patterns.

Examples

Sliding window with Redis: Implement a sliding window rate limiter using Redis sorted sets, where each request adds a timestamped entry and the window count is computed by ZRANGEBYSCORE over the last 60 seconds.

Tiered SaaS quotas: Free tier gets 100 requests/minute with no burst, Pro tier gets 1000 requests/minute with 2x burst for 10 seconds, Enterprise tier gets 10000 requests/minute with custom per-endpoint overrides.

Login endpoint protection: Apply strict rate limit of 5 attempts per minute per IP on /auth/login to prevent brute force attacks, with progressive lockout (15 min, 1 hour, 24 hours) after repeated violations.

See ${CLAUDE_SKILL_DIR}/references/examples.md for additional examples.

Resources

© jeremylongshore, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 3 other files (references) in skills/.curated/rate-limiting-apis of jeremylongshore/tons-of-skills-marketplace.

  • SKILL.md
  • references/errors.md
  • references/examples.md
  • references/implementation.md

Open the folder on GitHubat commit cfae287

Compare with similar skills

Rate Limiting APIs next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Rate Limiting APIs compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Rate Limiting APIs this skilljeremylongshore/tons-of-skills-marketplace2.8k—~1.4kAutomated safety check: PassMIT
Add Hosted Keysimstudioai/sim30k—~3.6kAutomated safety check: PassApache-2.0
Upstash Ratelimit TSupstash/ratelimit-js2k—~313Automated safety check: PassMIT
Repo2skillzhangyanxs/repo2skill246—~3.6kAutomated safety check: PassNone
Better Auth Security Best PracticesEpicenterHQ/epicenter4.8k—~896Automated safety check: PassCustom licence
Dload Fetch Toolphp-internal/dload105—~1.1kAutomated safety check: PassBSD-3-Clause

Similar skills

  • Add Hosted Key

    simstudioai/sim

    Add hosted API key support to a tool so Sim provides the key (metered and billed to the workspace) when a user has not brought their own.

    30k GitHub stars~3.6k tokensUpdated today
    Backend & APIsAuto-check passed

  • Upstash Ratelimit TS

    upstash/ratelimit-js

    Official

    Lightweight guidance for using the Redis Rate Limit TypeScript SDK, including setup steps, basic usage, and pointers to advanced algorithm, features, pricing, and traffic‑protection docs.

    2k GitHub stars~313 tokensUpdated 16 days ago
    Backend & APIsAuto-check passed

  • Repo2skill

    zhangyanxs/repo2skill

    Convert GitHub/GitLab/Gitee repositories into comprehensive OpenCode Skills using embedded LLM calls with multiple mirrors and rate limit handling

    246 GitHub stars~3.6k tokensUpdated 7 mo ago
    Backend & APIsAuto-check passed

  • Better Auth Security Best Practices

    EpicenterHQ/epicenter

    Better Auth security hardening: rate limits, secrets, CSRF, trusted origins, cookies, sessions, OAuth tokens, and audit logging.

    4.8k GitHub stars~896 tokensUpdated 3 days ago
    Backend & APIsAuto-check passed

  • Dload Fetch Tool

    php-internal/dload

    Get a CLI tool — native binary or PHAR — from a GitHub release into a project folder with dload (vendor/bin/dload).

    105 GitHub stars~1.1k tokensUpdated today
    Backend & APIsAuto-check passed

  • API Gateway

    itsmostafa/aws-agent-skills

    AWS API Gateway for REST and HTTP API management. An agent skill from itsmostafa/aws-agent-skills.

    1.2k GitHub stars~2.2k tokensUpdated 5 days ago
    Backend & APIsAuto-check passed

More from jeremylongshore/tons-of-skills-marketplace

All 3,342 skills in this repo

  • Performing Security Code Review

    jeremylongshore/tons-of-skills-marketplace

    Execute this skill enables AI assistant to conduct a security-focused code review using the security-agent plugin.

    2.8k GitHub starsUsed in 2 repos~1.3k tokens
    Auto-check: notes

  • Adapting Transfer Learning Models

    jeremylongshore/tons-of-skills-marketplace

    Build this skill automates the adaptation of pre-trained machine learning models using transfer learning techniques.

    2.8k GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Agent Context Loader

    jeremylongshore/tons-of-skills-marketplace

    Execute proactive auto-loading: automatically detects and loads agents.md files.

    2.8k GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Aggregating Performance Metrics

    jeremylongshore/tons-of-skills-marketplace

    Aggregate and centralize performance metrics from applications, systems, databases, caches, and services.

    2.8k GitHub stars~1.2k tokensUpdated today
    Auto-check passed

  • Analyzing Capacity Planning

    jeremylongshore/tons-of-skills-marketplace

    Execute this skill enables AI assistant to analyze capacity requirements and plan for future growth.

    2.8k GitHub stars~947 tokensUpdated today
    Auto-check passed

  • Analyzing Database Indexes

    jeremylongshore/tons-of-skills-marketplace

    Process use when you need to work with database indexing. An agent skill from jeremylongshore/tons-of-skills-marketplace.

    2.8k GitHub stars~2k tokensUpdated today
    Auto-check passed

Categories

Questions about Rate Limiting APIs

What does Rate Limiting APIs do?

Implement sophisticated rate limiting with sliding windows, token buckets, and quotas. Rate Limiting APIs is an agent skill from jeremylongshore/tons-of-skills-marketplace. Implement sophisticated rate limiting with sliding windows, token buckets, and quotas.

When should I use Rate Limiting APIs?

Rate Limiting APIs fits situations like: protecting APIs from excessive requests; with phrases like add rate limiting; limit API requests; implement rate limits.

How do I install Rate Limiting APIs in Claude Code?

Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill rate-limiting-apis -a claude-code`. Or copy the skill folder (skills/.curated/rate-limiting-apis in jeremylongshore/tons-of-skills-marketplace) into .claude/skills/rate-limiting-apis in your project. Claude Code loads it when a task matches its description.

How do I install Rate Limiting APIs in Codex?

Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill rate-limiting-apis -a codex`. Or copy the skill folder (skills/.curated/rate-limiting-apis in jeremylongshore/tons-of-skills-marketplace) into .agents/skills/rate-limiting-apis in your project. Codex loads it when a task matches its description.

Can I use Rate Limiting APIs in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill rate-limiting-apis -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/rate-limiting-apis, .gemini/skills/rate-limiting-apis, .github/skills/rate-limiting-apis and .opencode/skills/rate-limiting-apis in your project.

What does Rate Limiting APIs need to run?

SKILL.md names no scripts, command-line tools or credentials: Rate Limiting APIs is instructions for the agent only. Our summary lists: Node.js. Its frontmatter pre-approves these tools: Read, Write, Edit, Grep, Glob, Bash(api:ratelimit-*). Compatibility (from SKILL.md): Designed for Claude Code.

Does Rate Limiting APIs access the network?

SKILL.md names 2 domains. As links in the text: datatracker.ietf.org and github.com. This is read from the text; nothing was executed.

Is Rate Limiting APIs safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Rate Limiting APIs use?

Rate Limiting APIs is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Rate Limiting APIs use?

About 1.4k tokens (SKILL.md is roughly 5.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 2k tokens, read only when the agent opens those files.

What are the alternatives to Rate Limiting APIs?

Skills that share tags, products or a category with Rate Limiting APIs: Add Hosted Key (simstudioai/sim, 30k stars), Upstash Ratelimit TS (upstash/ratelimit-js, 2k stars), Repo2skill (zhangyanxs/repo2skill, 246 stars) and Better Auth Security Best Practices (EpicenterHQ/epicenter, 4.8k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Rate Limiting APIs?

jeremylongshore (a GitHub user) maintains it in jeremylongshore/tons-of-skills-marketplace, which has 2,827 GitHub stars. The repository holds 3,342 skills in this directory. The repository was last updated on October 10, 2026.

Source: jeremylongshore/tons-of-skills-marketplace on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.