Arcjet

Arcjet is a security SDK for rate limiting and bot protection, and one of the drivers behind limits. Pick it when you want rate decisions and bot detection from a service rather than counters you keep yourself.

limits:
  driver: arcjet

Before you start

1. Create an Arcjet account and a site for your app.
2. Copy the site's key into your secrets manager.

Configure

limits:
  driver: arcjet   # [to be decided] how the driver takes its key; suggested name ARCJET_KEY

Use it

import { auth, limits } from "mainsdk";

export async function POST(req: Request) {
  const session = await auth.require(req);
  const ok = await limits.rate(`export:${session.user.id}`, { per: "1m", max: 5 });
  if (!ok) return new Response("Too many requests", { status: 429 });
  return Response.json({ started: true });
}

Local development and testing

Use the builtin driver in development. In tests, createTestApp() from @mainsdk/testing runs limits on an in-memory fake, and clock.advance() resets windows without waiting. chaos.on("limits", { outage: true }) simulates Arcjet being unreachable.

What MainSDK adds on top

• Rate limits on sign-in, sign-up, password reset and AI calls by default.
• Abuse and bot protection as part of the interface.

See Rate limits and quotas.

Limits and notes

• limits has no spec yet, so how the bot protection and the IP allowlist per customer org map onto Arcjet is not decided yet.
• Limit by user or organisation ID rather than by personal data such as an email address.

Swap to or from it

limits:
  driver: arcjet   # was builtin

Your calls stay the same. Counters start fresh on the new driver.

FAQ

Does Arcjet replace sign-in limits? No. Those are on by default whichever driver you use.

Can I use Arcjet and Upstash together? One limits driver is active at a time.

Next

• Rate limits and quotas
• Upstash

Open questions