Rate Limits

gate.rate protects Flows from abuse and runaway clients. Limits run as atomic takes on the KV driver before do. Compose rates with policies via gate.all or list them on .gate(...).

For developers throttling login, writes, and expensive reads on okengine — declare the window, key the subject, attach on the trigger.

Smallest Example

import { gate } from "okengine";

export const loginThrottle = gate.rate({
  strategy: "sliding-window-counter", // default when omitted
  max: 5,
  per: "1m",
  keyBy: "ip",
  description: "Login attempts per IP",
});

import { on, flow, http, gate } from "okengine";
import { loginThrottle } from "@/core/gate";

export const login = on(
  http.post("/auth/sign-in/email").gate(gate.public, loginThrottle),
  flow({
    do: async (input, fx) => {
      // At most 5 takes per IP per minute
      return input;
    },
  }),
);

{
  "data": null,
  "error": {
    "code": "RateLimited",
    "message": "Too many requests. Try again later.",
    "data": { "retryAfterMs": 42000 }
  }
}

Progressive Patterns

From the default counter to bursty buckets and subject keys:

export const fair = gate.rate({ max: 60, per: "1m", keyBy: "user" });

Strategies

All five run as atomic Lua on the KV driver (memory / redis EVAL).

gate.rate({
  strategy: "sliding-window-counter", // or omit — this is the default
  max: 100,
  per: "1m",
  keyBy: "user",
});

Options

Consequence: rate gates need a KV driver in the app. Without KV, evaluation denies with telemetry reason "rate gate requires kv" and the typed code is still RateLimited.

Declare-time guards:

• gate.rate: max must be a positive number
• gate.rate: per is required

Invalid per at evaluation → deny with reason: "invalid per: …".

Naming & Overrides

The runtime name is always rate:{strategy}:{max}/{per}:

rate:sliding-window-counter:60/1m
rate:token-bucket:20/1m

When overridable: true, Console may tune max / per in Store without a code deploy. Leave it false (default) for hard product limits.

oke({ gate: { rateLimit: { enabled } } }) controls whether auth path Flows attach stricter presets. Default is true when gate.auth is on, false otherwise — it does not replace your own gate.rate declarations.

Troubleshooting

Learn more

• Gate Overview — chain order and denial mapping
• Authorization — policies on the same .gate(...)
• Store · KV — KV facet drivers
• HTTP — attach rates on REST routes

Next