naf / rate-limit

v0.1.0 2026-09-19 10:44 UTC

Requires

• php: >=8.3
• ext-pdo: *
• naf/framework: ^0.2

Requires (Dev)

• friendsofphp/php-cs-fixer: 3.95.25
• phpunit/phpunit: ^12.1

MIT

Published on Packagist.org on 2026-09-19 10:50 UTC

README

Count attempts, and refuse the ones over the line.

Atomic fixed-window counters in your database, registered as a rateLimit guard on NAF's existing Naf\guard() registry. Installing it intercepts nothing: the host chooses the keys, the limits and what a refusal looks like.

$decision = guard()->rateLimit('export:account:' . $accountId, 10, 60);

if (!$decision['allowed']) {
    return json(['error' => 'Too many requests'], 429)
        ->withHeader('Retry-After', (string) $decision['retry_after']);
}

🧩 Part of the official NAF plugin collection. Install it when something needs a limit, and nothing else.

Documentation

Read the documentation →

What this package does, how the limiter is wired to a connection and what a fixed window can and cannot promise lives in the NAF documentation. Not sure which packages you need? Start here.

Install

composer require naf/rate-limit

Needs ext-pdo and a database the host binds under PDO::class.

License

MIT. Part of NAF.