Upstash Redis + Next.js: Rate Limiting That Works at the Edge

npm install @upstash/ratelimit @upstash/redis

UPSTASH_REDIS_REST_URL=https://your-db.upstash.io
UPSTASH_REDIS_REST_TOKEN=your-token

// lib/rate-limit.ts
import { Ratelimit } from '@upstash/ratelimit'
import { Redis } from '@upstash/redis'

const redis = new Redis({
  url: process.env.UPSTASH_REDIS_REST_URL!,
  token: process.env.UPSTASH_REDIS_REST_TOKEN!,
})

// 10 requests per 10 seconds per IP
export const rateLimiter = new Ratelimit({
  redis,
  limiter: Ratelimit.slidingWindow(10, '10 s'),
  analytics: true,
  prefix: 'rl:api',
})

// Separate limiter for expensive AI endpoints
export const aiRateLimiter = new Ratelimit({
  redis,
  limiter: Ratelimit.slidingWindow(3, '60 s'),
  analytics: true,
  prefix: 'rl:ai',
})

// app/api/chat/route.ts
import { NextRequest, NextResponse } from 'next/server'
import { aiRateLimiter } from '@/lib/rate-limit'
import Anthropic from '@anthropic-ai/sdk'

export const runtime = 'edge'

export async function POST(req: NextRequest) {
  // Get identifier — prefer authenticated user ID, fall back to IP
  const ip = req.headers.get('x-forwarded-for')?.split(',')[0] ?? 'anonymous'
  const identifier = ip

  const { success, limit, remaining, reset } = await aiRateLimiter.limit(identifier)

  if (!success) {
    return NextResponse.json(
      { error: 'Rate limit exceeded. Try again in a moment.' },
      {
        status: 429,
        headers: {
          'X-RateLimit-Limit': limit.toString(),
          'X-RateLimit-Remaining': remaining.toString(),
          'X-RateLimit-Reset': reset.toString(),
          'Retry-After': Math.ceil((reset - Date.now()) / 1000).toString(),
        },
      }
    )
  }

  const { messages } = await req.json()
  const client = new Anthropic()

  const response = await client.messages.create({
    model: 'claude-sonnet-4-6',
    max_tokens: 2048,
    messages,
  })

  return NextResponse.json({
    content: response.content[0].type === 'text' ? response.content[0].text : '',
    remaining,  // Let clients show remaining quota
  })
}

// middleware.ts
import { NextRequest, NextResponse } from 'next/server'
import { Ratelimit } from '@upstash/ratelimit'
import { Redis } from '@upstash/redis'

const redis = new Redis({
  url: process.env.UPSTASH_REDIS_REST_URL!,
  token: process.env.UPSTASH_REDIS_REST_TOKEN!,
})

const limiter = new Ratelimit({
  redis,
  limiter: Ratelimit.slidingWindow(20, '10 s'),
  prefix: 'rl:mw',
})

export const config = {
  matcher: ['/api/:path*'],
}

export async function middleware(req: NextRequest) {
  const ip = req.headers.get('x-forwarded-for')?.split(',')[0] ?? 'anonymous'
  const { success, remaining } = await limiter.limit(ip)

  if (!success) {
    return new NextResponse(JSON.stringify({ error: 'Too many requests' }), {
      status: 429,
      headers: { 'Content-Type': 'application/json' },
    })
  }

  const res = NextResponse.next()
  res.headers.set('X-RateLimit-Remaining', remaining.toString())
  return res
}

// app/api/ai/generate/route.ts
import { auth } from '@clerk/nextjs/server'
import { NextRequest, NextResponse } from 'next/server'
import { aiRateLimiter } from '@/lib/rate-limit'

export async function POST(req: NextRequest) {
  const { userId } = await auth()

  // Authenticated users get per-user limits; anonymous get per-IP limits
  const identifier = userId ?? req.headers.get('x-forwarded-for')?.split(',')[0] ?? 'anon'
  const prefix = userId ? `user:${userId}` : `ip:${identifier}`

  const { success, remaining } = await aiRateLimiter.limit(prefix)

  if (!success) {
    return NextResponse.json(
      { error: userId ? 'Plan limit reached' : 'Rate limit exceeded' },
      { status: 429 }
    )
  }

  // ... handle request
}

// lib/rate-limit.ts
import { Ratelimit } from '@upstash/ratelimit'
import { Redis } from '@upstash/redis'

const redis = new Redis({
  url: process.env.UPSTASH_REDIS_REST_URL!,
  token: process.env.UPSTASH_REDIS_REST_TOKEN!,
})

const PLAN_LIMITS = {
  free: { requests: 10, window: '1 h' },
  starter: { requests: 100, window: '1 h' },
  pro: { requests: 1000, window: '1 h' },
  enterprise: { requests: 10000, window: '1 h' },
} as const

type Plan = keyof typeof PLAN_LIMITS

const limiters = Object.fromEntries(
  Object.entries(PLAN_LIMITS).map(([plan, { requests, window }]) => [
    plan,
    new Ratelimit({
      redis,
      limiter: Ratelimit.slidingWindow(requests, window),
      prefix: `rl:plan:${plan}`,
    }),
  ])
) as Record<Plan, Ratelimit>

export async function checkPlanLimit(userId: string, plan: Plan) {
  return limiters[plan].limit(userId)
}