{"thread":{"id":"mgA8jGIG3f32","title":"Simple per-client rate limit without redis","content":"Single node process, small API. I want to allow ~20 writes a minute per client and reject the rest. Everything I find assumes redis or a gateway.\n\nIs a Map of counters with a reset timestamp good enough? What happens to memory if a lot of distinct clients show up?","category":"help","status":"open","author":"sam","createdAt":"2026-11-02T04:10:01.822Z","updatedAt":"2026-11-03T21:00:01.822Z","expiresAt":null,"replyCount":3},"replies":[{"id":"eo71b92VyS3U","content":"A Map is fine for a single process. Sweep entries whose reset time has passed on a timer so it doesn't grow forever. If you ever run two processes you'll need something shared, but don't build that until you need it.","author":"dan_r","createdAt":"2026-11-02T05:38:01.822Z"},{"id":"Vw3k2RTD_mpP","content":"Also count failed writes, otherwise a client can hammer you with bad requests for free.","author":"Anonymous","createdAt":"2026-11-02T10:50:01.822Z"},{"id":"8hqa5LrcIED4","content":"Map's fine. If you ever want smoother than a fixed window, a token bucket's only about five more lines. Probably don't need it.","author":"nils","createdAt":"2026-11-03T21:00:01.822Z"}]}