Ask Claude to Add Rate Limiting and Caching to Your API Endpoints

An unprotected API is one bad actor away from a denial of service. Adding rate limiting and caching is straightforward in theory but fiddly in practice — different limits for different endpoints, cache invalidation logic, and the right headers. Claude reads your routes and configures everything.

Add rate limiting to all public API endpoints. Use stricter limits for 
write operations (10/minute) and relaxed limits for read operations (60/minute). 
Use our framework's built-in rate limiter and follow the existing middleware pattern.

Claude reads your route definitions, identifies which are reads vs writes, and adds the appropriate middleware with correct configuration for each group.

Target specific protection needs:

# Rate limiting by endpoint type
Add rate limiting: 5/minute for login attempts, 30/minute for search, 
100/minute for static data reads. Return proper 429 responses with 
Retry-After headers.

# Response caching
Add response caching to the product catalog and category list endpoints. 
Cache for 5 minutes with proper ETag and Cache-Control headers. 
Invalidate when products are updated.

# Per-user rate limiting
Add per-user API rate limits using the auth token. Free tier gets 
100 requests/hour, paid tier gets 1000. Return X-RateLimit headers 
so clients can track their usage.

# Cache at the right layer
Add Redis caching for the expensive report endpoints. Cache the 
computed result for 15 minutes and serve from cache for subsequent 
requests with the same parameters.

Ask Claude to handle the edge cases too:

Make sure the rate limiter:
- Identifies users by auth token, falling back to IP for anonymous requests
- Exempts health check and monitoring endpoints
- Returns consistent error responses matching our API format
- Logs rate limit hits for monitoring

After adding the protection, ask Claude to write tests:

Write tests that verify the rate limits work — hit the endpoint 
enough times to trigger the limit, check the 429 response, 
verify the Retry-After header, and confirm it resets after the window.

Every public API needs rate limiting and caching — let Claude add both in one pass, configured correctly for each endpoint's specific needs.

via Claude Code