Better Auth Atomic Rate Limit

A Redis-backed rateLimit.customStorage for Better Auth 1.7, which replaced the old get/set storage pair with a single required atomic consume call. INCR and PEXPIRE run inside one Lua invocation so concurrent sign-in attempts cannot all pass the same stale count, repairs a counter key left without an expiry, rounds Retry-After up, fails closed by default when Redis is unreachable, and keeps the client identifier out of the error path. Typed against the published storage interface and shaped for the Upstash eval signature with an ioredis adapter note.

Install

npx shadcn@latest add https://ui.aryank.space/r/better-auth-atomic-rate-limit.json

Installs from ui.aryank.space. To add it by hand, copy the files in Files below, or register the @compronents namespace via the docs.

Visualization

storage

attempt A

Promise<number | null>

attempt B

Promise<number | null>

limit

unknown


const n = await get(key); if (n < 5) await set(key, n + 1) // both read 4

Two concurrent sign-in attempts both GET the counter, both read 4, both decide 4 < 5 passes, and both SET it to 5. The limit admitted six attempts out of a budget of five, because the read and the write were separate round trips a race could fit between.

Files

Dependencies

[email protected]

src

better-auth-atomic-rate-limit