Edge Security Engine

API Protection & Rate Limiting at the Edge

ShieldLimit provides sub-10ms request evaluation at the edge using Redis state synchronization, sliding-window algorithms, and cryptographically signed keys.

Sub-10ms Evaluation

Global edge execution prevents latency spikes while validating incoming traffic against defined counters.

Secure Storage

API secrets are salted and stored using SHA-256 hashes with automatic key turnover support.

Quick Start

3-Step Integration

Install SDK

Add @esbi/shieldlimit to your project dependencies.

Set Key

Store your SHIELD_KEY in your server environment.

Protect Routes

Wrap incoming request handlers with shield.verify().

SDK Usage

Official Node.js / Next.js SDK

npm install @esbi/shieldlimit

import { ShieldLimit } from "@esbi/shieldlimit";

const shield = new ShieldLimit({ apiKey: process.env.SHIELD_KEY! });

export async function middleware(req: Request) {
  const identifier = req.headers.get("x-user-id") || "anonymous";
  const { success, remaining, reset } = await shield.verify(identifier);

  if (!success) {
    return new Response("Too Many Requests", {
      status: 429,
      headers: { "X-RateLimit-Reset": reset.toString() }
    });
  }
}

REST Endpoint

Direct Verification HTTP API

POSThttps://rate-limiter-swart.vercel.app/api/v1/verify

curl -X POST https://rate-limiter-swart.vercel.app/api/v1/verify \
  -H "x-shield-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"identifier": "user_or_ip_address"}'

Headers

Request & Response Headers

Header	Type	Description
x-shield-key	Request	Secret project API key issued in dashboard.
X-RateLimit-Limit	Response	Maximum allowed requests per window.
X-RateLimit-Remaining	Response	Remaining permitted requests in active window.
X-RateLimit-Reset	Response	Unix timestamp (seconds) when bucket resets.

Response Codes

HTTP Status Responses

200 OK

API key is valid and current traffic is within configured limits.

Allowed

401 Unauthorized

Missing or malformed x-shield-key header.

Invalid Auth

403 Forbidden

Request origin domain does not match allowed CORS list.

Origin Blocked

429 Too Many Requests

Quota limit exceeded. Retry after duration indicated in X-RateLimit-Reset.

Throttled

Sample JSON Body (200 OK)

{
  "success": true,
  "limit": 100,
  "remaining": 99,
  "resetAt": 1718299200
}

Ready to secure your endpoints?

Create a free project key and protect your API routes in under 5 minutes.

Get Free API Keys