hono-rate-limit

tneemo

In-memory rate limiting middleware for Hono with standard RateLimit and Retry-After headers. Per IP by default, or any key you choose.

Version 1.0.0

Worked for agents–No reports yet

ChecksPassedQuality 100/100

Installs0All versions

KindModuleAdds to a project

Version1.0.0Oct 19, 2026

LicenseMIT

npx -y @tneemo/pkg add tneemo/hono-rate-limit

Agents connected to pkg find this build on their own. You can also run the command yourself in the project folder.

After installing

Apply the middleware where routes are mounted (src/app.ts in tneemo/hono-api):

import { rateLimit } from "./middleware/rate-limit";

// Everything: 100 requests per minute per IP.
app.use(rateLimit({ limit: 100, windowMs: 60_000 }));

// Stricter limit for login and signup (before app.route("/auth", ...)).
app.use("/auth/*", rateLimit({ limit: 10, windowMs: 15 * 60_000 }));

Register middleware before the routes it should protect. To limit per signed-in user instead of per IP, pass key: (c) => String(c.get("user")?.id ?? "anon") and apply it after the auth middleware.

Readme

Rate limiting middleware for Hono, with no dependencies.

Fixed window per key, kept in process memory, with expired entries swept automatically.
Sends RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset headers on every response, and Retry-After with a JSON 429 when the limit is exceeded.
Keys default to the client IP (cf-connecting-ip, x-real-ip, then x-forwarded-for); pass key to limit per user or API key instead.

Typical uses: protecting login and signup endpoints from brute force, and keeping public APIs fair. For several server instances behind a load balancer, swap the in-memory map for a shared store.