const requestPerSecond = 2 const seconds = 60 const windowMs = seconds * 1000 app.enable('trust proxy') app.use( rateLimit({ windowMs, max: seconds * requestPerSecond, handler: () => { throw new TooManyRequestsError() } }) ) code example

Example: express limit based on ip

const rateLimit = require('express-rate-limit');

const limiter = rateLimit({
  max: 100,
  windowMs: 60 * 60 * 1000,
  message: 'too many requests sent by this ip, please try again in an hour !'
});

app.use('<routes>', limiter);  // eg: app.use('/api', limiter);