---
title: "Arcjet"
description: "Use Arcjet for MainSDK rate limits and bot protection - setup, main.yaml, limits.rate, local testing and swapping."
section: "integrations"
canonical: "https://mainsdk.dev/docs/integrations/arcjet"
updated: "2026-10-28"
---

# Arcjet

> Use Arcjet for MainSDK rate limits and bot protection - setup, main.yaml, limits.rate, local testing and swapping.

Canonical: https://mainsdk.dev/docs/integrations/arcjet · Updated: 2026-10-28

Arcjet is a security SDK for rate limiting and bot protection, and one of the drivers behind [`limits`](https://mainsdk.dev/docs/interfaces/limits). Pick it when you want rate decisions and bot detection from a service rather than counters you keep yourself.

> **Note:** `limits` has no spec yet. The calls and options on this page are provisional, taken from the catalog and the product requirements, and may change when the spec lands.

## Interfaces it serves

### Rate limits and quotas (`limits`)

- Status: Building for 0.3 · ships as a beta API
- Driver: `arcjet` (Arcjet). later
- Docs: https://mainsdk.dev/docs/interfaces/limits.md

```yaml
limits:
  driver: arcjet
```

Swap to another provider: `local`, `redis`.

## Before you start

1. Create an Arcjet account and a site for your app.
2. Copy the site's key into your secrets manager.

## Configure

```yaml title="main.yaml"
limits:
  driver: arcjet   # [TBD] how the driver takes its key; suggested name ARCJET_KEY
```

## Use it

```ts title="app/api/export/route.ts"
import { auth, limits } from "mainsdk";

export async function POST(req: Request) {
  const session = await auth.require(req);
  const ok = await limits.rate(`export:${session.user.id}`, { per: "1m", max: 5 });
  if (!ok) return new Response("Too many requests", { status: 429 });
  return Response.json({ started: true });
}
```

## Local development and testing

Use the `builtin` driver in development. In tests, `createTestApp()` from `@mainsdk/testing` runs `limits` on an in-memory fake, and `clock.advance()` resets windows without waiting. `chaos.on("limits", { outage: true })` simulates Arcjet being unreachable.

## What MainSDK adds on top

- Rate limits on sign-in, sign-up, password reset and AI calls by default.
- Abuse and bot protection as part of the interface.

See [Rate limits and quotas](https://mainsdk.dev/docs/interfaces/limits).

## Limits and notes

- `limits` has no spec yet, so how the bot protection and the IP allowlist per customer org map onto Arcjet is [TBD].
- Limit by user or organisation ID rather than by personal data such as an email address.

## Swap to or from it

```yaml title="main.yaml"
limits:
  driver: arcjet   # was builtin
```

Your calls stay the same. Counters start fresh on the new driver.

## FAQ

**Does Arcjet replace sign-in limits?** No. Those are on by default whichever driver you use.

**Can I use Arcjet and Upstash together?** One `limits` driver is active at a time.

## Next

- [Rate limits and quotas](https://mainsdk.dev/docs/interfaces/limits)
- [Upstash](https://mainsdk.dev/docs/integrations/upstash)