---
title: Rate limiting
description: "A fixed-window limiter, counted per key per binding."
---

## Configuration

```jsonc
"ratelimiters": [{ "binding": "API", "limit": 100, "period": 60 }]
```

`limit` and `period` (in seconds) are fixed in `sproutboat.jsonc`.

## Usage

```js
const { success, resetAt } = env.API.limit({ key: request.cf.clientIp });
if (!success) {
  const retryAfter = Math.ceil((resetAt - Date.now()) / 1000);
  return new Response("slow down", { status: 429, headers: { "retry-after": String(retryAfter) } });
}
```

## Method

| Method | Signature | Returns |
| --- | --- | --- |
| `limit` | `({ key })` | `{ success, resetAt }`. `resetAt` is when the window resets, in epoch milliseconds. |

:::warning
The window is fixed, so a burst that straddles a window boundary can briefly reach about twice `limit`.
:::