Control
Rate limits that contain abuse at the edge
ArxLayer enforces per-route and per-identity request limits before traffic reaches your origin. Cap login attempts, throttle scrapers, and absorb spikes without writing code in your app.
The problem
One client shouldn't be able to overwhelm a route
Brute-force logins, aggressive scrapers, and runaway clients all look like one thing: too many requests, too fast.
Credential stuffing & brute force
Login and token endpoints get hammered with guesses until something works or your origin buckles.
Scraping & API abuse
Automated clients pull data far faster than any human, draining capacity and inflating cost.
Spikes reach the origin
Without an edge limit, every burst lands on your servers and competes with real users.
What you get
Limits that fit the route and the caller
Define what a request is too many of, by path and by identity, and enforce it before the origin ever sees the traffic.
Per-route limits
Set a strict cap on a login or token endpoint and a looser one on a public page, independently.
Per-identity counting
Count by client identity, not just by IP, so one caller can't fan out across addresses to evade a limit.
Approximate or strict mode
Default per-node counting is fast and low-overhead; switch to strict mode when you need tighter coordination.
Shed instead of fall over
Excess requests are rejected at the edge with a clear response, keeping the route available for everyone else.
Versioned, reversible policy
Every limit change is a new version you can review and roll back in seconds.
See what's being throttled
Throttling events surface in analytics so you can confirm a limit is catching abuse, not real users.
How it works
From definition to enforcement
Pick the routes that need protection, set the threshold, and let the edge enforce it.
Choose routes and keys
Select the paths to protect and whether to count by identity, IP, or both.
Set the threshold
Define the request budget and window for each route, from strict login caps to generous API allowances.
Enforce at the edge
ArxLayer Edge counts and sheds excess requests locally, before they reach your origin.
FAQ
Questions, answered
- How does approximate mode differ from strict mode?
- Approximate mode counts requests per edge node, which is fast and low-overhead but allows some slack across nodes. Strict mode coordinates counting more tightly when you need a harder ceiling.
- Can I rate limit logins separately from the rest of my API?
- Yes. Limits are per-route, so you can apply a tight cap to login and token endpoints while leaving other paths on a looser budget.
- Does rate limiting use the client's raw IP?
- Counting can key on identity or on a hashed client IP. Raw IPs are not retained for reputation; the edge request path is local and in-memory.
- What does a client see when it's limited?
- Excess requests are rejected at the edge with a clear throttling response, while requests within budget pass through to your origin untouched.
Put a ceiling on abuse
Set per-route and per-identity limits at the edge and contain spikes, scraping, and brute force before they reach your origin.