Upstash Rate Limiter

Use Upstash Redis in Better Auth.

This is not a traditional Better Auth plugin. You do not add it to plugins: []. It is a rateLimit wrapper your for Better Auth config.

Installation

Install dependencies

Coming soon: npm package installation is not published yet.

npm install @better-auth-plugins/plugins @upstash/redis

Create your Redis client

lib/redis.ts

import { Redis } from "@upstash/redis";

export const redis = new Redis({
  url: process.env.UPSTASH_REDIS_REST_URL!,
  token: process.env.UPSTASH_REDIS_REST_TOKEN!,
});

lib/redis.ts

import { Redis } from "@upstash/redis";

export const redis = new Redis.fromEnv()

Add `upstashRateLimiter` to `rateLimit`

auth.ts

import { betterAuth } from "better-auth";
import { upstashRateLimiter } from "@better-auth-plugins/plugins/upstash";
import { redis } from "./lib/redis";

export const auth = betterAuth({
  rateLimit: upstashRateLimiter({
    redis,
    window: 10,
    max: 100,
  }),
});

Better Auth options still work

upstashRateLimiter passes Better Auth rate-limit options through, while injecting custom storage.

That means things like enabled, window, max, customRules, and advanced behavior are still handled by Better Auth.

auth.ts

export const auth = betterAuth({
  rateLimit: upstashRateLimiter({
    redis,
    window: 10,
    max: 100,
    customRules: {
      "/sign-in/email": {
        window: 10,
        max: 3,
      },
      "/two-factor/*": async (request) => {
        return {
          window: 10,
          max: 3,
        };
      },
    },
  }),
});

API

upstashRateLimiter(options)
createUpstashRateLimitStorage(options)

`options`

redis: { get(key), set(key, value, { ex }) } (required)
All Better Auth rateLimit options except customStorage and storage