Setting Up Rate Limiting for Routes

Introduction

Zen Firewall by Aikido allows you to set up rate limiting on routes to protect your application from abuse, such as preventing excessive password reset requests. You can rate limit, webpages, REST API routes as well as GraphQL APIs.

Check the functionality support matrix to see if your framework supports rate limiting.

Supported Functionality

• Set rate limiting on specific routes

• Set rate limiting on multiple routes by adding a wildcard* route

• Set rate limiting on IP address or user ID, or a custom group ID (e.g. company ID for B2B SaaS)

• Disable protection for a specific route instead disabling protection for your entire app.

• Localhost or 127.0.0.1 is never rate limited

Rate limiting is based on individual IP addresses or user identification. For example, if the limit is 10 requests per minute:

• ❌ Blocked: A single IP making 11 requests will be

• ✅ Allowed: 11 different IPs making one request each

This helps prevent abuse while allowing normal traffic from multiple users.

How to set up rate limiting

Step 1: Navigate to a specific app and open the Routes tab

Step 2: Open Action Menu of the specific route you wish to apply rate limiting to. Clicking Setup rate limiting will open a modal.

API routes management interface showing method, route, app name, rate limiting, and status.

Step 3: Enable Rate Limiting and specify the number of requests allowed per timeframe. Save by updating the routes.

Enable and configure rate limiting for PATCH requests to /api/v2/posts/:number.

Config changes take up to 1 minute to take effect.

Setting up rate limiting for multiple routes at once

You can set up rate limiting for multiple routes at once by adding a wildcard route.

Step 1. On the routes page, click Add Route.

API routes table showing route, app name, rate limiting, and protected status.

Step 2. Add a wildcard route by adding an * in the route.

Add an API route with rate limiting in Aikido Firewall settings.

Step 3. The wildcard will appear now in the list. Proceed to set up rate limiting the same way as above.

POST /auth/* route: Demo app, 10 requests/min, Protected status.

How it works

Order of operations

Aikido Zen enforces rate limits in the following order of priority:

1. Group level

2. User level

3. IP level

Once a request is rate limited at a higher level (e.g., group), the lower levels (user or IP) are not evaluated.

Sliding window

Tracks events using a moving time frame that continuously slides forward. Unlike fixed windows that reset at specific times, sliding windows maintain a rolling count of the most recent period (e.g., last 60 seconds). This prevents edge cases where brief traffic spikes could bypass limits at window boundaries.

Route selection (wildcards)

Zen will first select the exact route match (without wildcards) to apply a rate limit. If no exact route is found wildcard matches are applied based on the lowest limit. Only one limit is applied at any given time, a single requests will never hit multiple limits.

Group-based rate limiting

To limit the number of requests for a group of users, you can use the setRateLimitGroup function. This is useful if you want to limit the number of requests per team or company. Please note that if a rate limit group is set, the configured rate limits are only applied to the group and not to individual users or IP addresses.

Available for:

• Node.js

• Python

• Java

• Other agents will follow soon