mybasev1.0.21

Rate limits

Shared rate limits (sliding window, fixed window, token bucket) that every instance of your app checks.

Named rules (or inline limits) that every instance of your app checks through mybase, so limits hold across servers.

mybase ratelimit enable shop
mybase ratelimit create shop login --limit 5 --window 1m
mybase ratelimit stats shop

In apps: createRateLimiter from @mybase-dev/sdk/ratelimit with an API key that has ratelimit:write, then await limiter.limit("login", ip). Algorithms: sliding (default), fixed, token (with burst). Rules can live in mybase.config.ts (mybase ratelimit sync). Guide: SDK rate limits.

Security

  • Set failClosed: true on sign-in, sign-up, password reset, and payment routes; by default the SDK fails open when mybase is unreachable.
  • Limit by user or key id where you can; IP-based limits behind a proxy depend on the proxy setup.

More: Security best practices.

Agent notes

  • The SDK fails open (allows) on network errors unless failClosed is set.
  • Counters live in the cache server; eviction under memory pressure can reset a count early.

Cache

A Redis-compatible keyspace per project, over TCP with any Redis client or over HTTP with an API key.

Analytics

Cookieless page views, custom events, and errors from your app, with a script tag or the SDK.

On this page

SecurityAgent notes