tower-rate-limiter

Crates.io · Documentation

Keyed, fixed-window HTTP rate limiting middleware for Tower. Limit repeated requests by account, API client, peer address, or any other application-defined identity.

Tower-first core with optional Axum integration
Fixed or request-derived quotas
Process-local memory and shared Redis Stores
Custom keys, responses, bypass rules, and Store failure behavior
Optional structured tracing for Store failures
IETF RateLimit and RateLimit-Policy response fields

Guide · API documentation · Examples

Quick start

The default feature includes the process-local MemoryStore. The crate requires Rust 1.96 or newer.

[dependencies]
tower-rate-limiter = "0.1"

use std::time::Duration;
use tower::Layer;
use tower_rate_limiter::{IpKeyExtractor, MemoryStore, RateLimitLayer};

let limiter = RateLimitLayer::builder(IpKeyExtractor::new())
    .policy_name("public-api")
    .limit(100)
    .window(Duration::from_secs(60))
    .with_store(MemoryStore::new())
    .build()
    .expect("valid rate-limit policy");

let service = limiter.layer(inner_service);

The Store is always explicit through .with_store(...). IpKeyExtractor reads only the peer SocketAddr from request extensions; Axum applications must provide ConnectInfo. Behind a trusted proxy, TrustedProxyClientIpKeyExtractor accepts an application-supplied peer trust policy before checking supported client-IP headers. ClientIpKeyExtractor preserves header-first behavior for deployments where every request is already restricted to a trusted proxy. Header-derived identity is safe only when the proxy removes or overwrites every accepted header. See the quick-start guide for a complete runnable example.

Stores

Store	Use when
`MemoryStore`	One process owns the quota, or for local development
`RedisStore`	Multiple processes must share one quota
Custom `Store`	The application needs another counter backend

For Redis with Tokio and the default transaction implementation:

[dependencies]
tower-rate-limiter = {
    version = "0.1",
    default-features = false,
    features = ["redis", "runtime-tokio"],
}

Use redis-lua instead of redis for the Lua implementation, or runtime-smol instead of runtime-tokio for Smol. The application provides an established Redis connection and owns its lifecycle.

Documentation

Topic	Guide
Installation and first Layer	Quick start
Charging and fixed-window semantics	How it works
Builder options and failure behavior	Configuration
Axum, Redis, and proxy considerations	Adapters
Custom keys, quotas, Stores, and responses	Custom components
Response field formats	Rate Limit fields
Deployment checklist	Production guide

Runnable Tower, Axum, dynamic-quota, proxy, and Redis integrations are collected in examples/.

Contributing

Bug reports, feature requests, and contributions are welcome through GitHub Issues.

License

Licensed under either