Most rate limiters fail under real traffic because they track requests per-minute instead of allowing bursts. Here’s a token bucket approach that holds up.

Why token buckets

A bucket refills at a fixed rate and drains on each request. It smooths out spikes without blocking legitimate bursts of traffic.

function take(n) {
  tokens -= n;
}

Next, wire this into an Express middleware and add Redis so limits survive a server restart.