Rate-limit control for Go services

Keep traffic inside the lines.

Four algorithms, in-memory or Redis state, resource-level policies, HTTP middleware, and Prometheus metrics behind one small Go API.

Start in 60 seconds Choose an algorithm

request trace / 0042

resourcelogin

keytenant-a:user-123

policy5 req / 1m · sliding

backendredis · atomic lua

decisionDENY · retry 12s

4 algorithmsfixed, sliding, token, leaky

2 backendsin-memory and Redis

4 adaptersHTTP, Gin, Fiber, Echo

1 decisionallow or deny with metadata

Install

go get github.com/AliRizaAynaci/gorl/v2

Create a limiter, give each caller a stable key, and close the limiter when the application shuts down:

limiter, err := gorl.New(core.Config{
    Strategy: core.SlidingWindow,
    Limit:    100,
    Window:   time.Minute,
})
if err != nil {
    log.Fatal(err)
}
defer limiter.Close()

result, err := limiter.Allow(ctx, "tenant-a:user-123")

Run the complete quickstart

Pick the policy shape

Strategy	Traffic shape	Primary strength	Watch for
Fixed window	Hard count per clock bucket	Lowest conceptual and state cost	Boundary bursts
Sliding window	Weighted current and previous buckets	Smoother enforcement	Approximation and more state
Token bucket	Capacity refills continuously	Controlled bursts	Starts with a full bucket
Leaky bucket	Occupancy drains continuously	Steady admission pressure	It meters; it does not queue work

All four algorithms support both bundled backends. The built-in Redis paths use Lua scripts for atomic state transitions across application instances.

Compare algorithms in depth

Follow a request

flowchart LR
    accTitle: GoRL request decision flow
    accDescr: A request is mapped to a key and policy, evaluated against backend state, then allowed or rejected with metadata.
    Request[HTTP request] --> Select[Extract key and resource]
    Select --> Policy[Select policy]
    Policy --> State[(In-memory or Redis state)]
    State --> Decision{Allowed?}
    Decision -->|yes| Handler[Application handler]
    Decision -->|no| Reject[429 response]
    Decision --> Metadata[Limit, remaining, reset, retry]

The application owns identity and resource selection. GoRL owns policy evaluation, state transitions, result metadata, and optional metrics.

Go deeper

Model Keys and resources

Design tenant-safe identities and attach different policies to named operations.

Production Operate with Redis

Understand atomicity, latency budgets, cluster key placement, and failure policy.

Integration Protect HTTP endpoints

Use net/http, Gin, Fiber, or Echo and return useful rate-limit metadata.

Operations Diagnose unexpected decisions

Work through shared buckets, proxy headers, Redis startup, and registration errors.

API lookup

Use the curated public API reference for contracts and semantics, then switch to pkg.go.dev for package indexes and exact exported declarations.