Rate limiting, hosted

One call.Every request.

Brume is a rate-limiting gateway built in Rust. Four algorithms, per-identifier overrides, quotas, and blocklists — one HTTP call, one flat-rate bill.

Start buildingRead the docs
brume limit / 001
one call · one verdict
Your traffic
API server
Edge function
Background jobs
Brume Limitrate-limiting gateway
Rules
4 algorithms
Overrides
per identifier
Quotas
long windows
Blocklists
deny / allow
The verdict
200 · allowed429 · over limitX-RateLimit-* headers
evaluateoverridequotablock
4 algorithms0 Redis to manage1 flat-rate bill
Why hosted

Rate limiting is a solved problem. Stop solving it.

Every team rebuilds the same counters, the same Lua scripts, the same edge cases. Brume runs them for you.

Roll your own
Redis to operate
01
Lua scripts to maintain
02
Per-command metering
03
Counters in your app code
04
Your bugs, your pager, forever
With Brume
one call
One HTTP call
01
Four algorithms
02
Overrides, quotas, blocklists
03
One flat-rate bill
04
One call → every verdict
Brume Limit

The whole rate-limiting surface.

Rules are the start. Overrides, quotas, blocklists, and analytics are built in, not bolted on.

Algorithmstoken bucket · fixed · sliding log · sliding counter
Pick your policy
Token bucket
Smooth traffic with optional burst capacity.
01
Fixed window
Simple per-window counter, predictable resets.
02
Sliding window log
Exact timestamps, strictest fairness.
03
Sliding window counter
Approximate rolling rate, constant memory.
04
TypeScript
import { createLimitClient } from '@brume/limit'

const limit = createLimitClient({
  apiKey: proces..._KEY,
})

const result = await limit.limit('api', user.id)

if (!result.success) {
  return new Response('Too many requests', {
    status: 429,
    headers: { 'Retry-After': String(result.retry_after) },
  })
}
Beyond the ruleoverrides · quotas · blocklists · analytics
Per-identifier overrides

One user needs a higher limit? Give that identifier its own cap without creating a second rule. The override shares the rule's counter and inherits whatever you leave unset.

Long-window quotas

Rate rules handle bursts; quotas handle budgets. Monthly, weekly, and daily caps with billing-cycle-aware resets, enforced alongside the rate rule.

Block & allow lists

Deny or admit IPs and keys before any rule runs. A blocked identifier never consumes capacity; an allowed one never gets denied.

Per-identifier analytics

See which identifiers are hitting limits, not just that limits were hit. Allowed, denied, and remaining, broken down per namespace.

Pricing

A number you can put in a budget.

No per-request metering. No tier-jumping. Flat-rate caps on check volume — exceeding one rejects, it never invoices.

Free
$0
Forever free
10,000 checks/day5 rules · 3 namespacesOverrides · quotas · blocklists
Select Free
Starter
$19
per month
250,000 checks/day25 rules · 10 namespacesOverrides · quotas · blocklists
Select Starter
Pro
Popular
$49
per month
1,000,000 checks/day100 rules · 50 namespacesOverrides · quotas · blocklists
Select Pro
Business
$99
per month
5,000,000 checks/dayUnlimited rules · Unlimited namespacesOverrides · quotas · blocklists
Select Business
Token bucketFixed windowSliding window logSliding window counterOverridesQuotasBlocklistsAnalyticsFlat-rate pricing
Architecture

Built for teams that already run an API.

Atomic Lua evaluation, a dedicated Redis you never touch, and fail-open behavior you can see. Your infrastructure, your rules.

Rust core

No garbage collector, no virtual machine, no runtime to install. The server is small, fast, and predictable under load.

Atomic Lua evaluation

Every check runs as one atomic script against a dedicated Redis. No race windows, no double-counting, no app-side locking.

Fail-open by design

If Redis goes down, checks return success with degraded: true. Availability over correctness, and you get to see it happened.

FAQ

Questions, answered.

What is Brume?

Brume is a rate-limiting gateway built in Rust. You define rules, evaluate requests against them with one HTTP call, and read standard X-RateLimit headers. Overrides, quotas, blocklists, and per-identifier analytics are built in.

How is this different from running my own Redis counters?

You stop owning the hard parts: atomic evaluation, sliding-window math, cache invalidation across nodes, fail-open behavior, and the dashboard. Brume runs a dedicated Redis for you and exposes it as one HTTP call.

What happens when Redis is down?

Checks fail open: the gateway returns success with degraded: true so your traffic keeps moving. You decide the tradeoff — the SDK also supports a deny-on-error mode if correctness matters more than availability.

Is there a free tier?

Yes. 10,000 checks/day, 5 rules, all four algorithms, quotas, and blocklists. No credit card required, no time limit.

What is actually metered?

Nothing. Every tier is a flat rate with capacity caps. Exceeding a cap rejects new requests with a PLAN_LIMIT error — nothing is invoiced retroactively.

Documentation

First check in five minutes.

View docs