Other
Flat-Rate Correct Rate Limiting & Abuse Protection
In-code rate limiting, quota and bot protection with a correctness contract, priced flat per account for unlimited apps, seats and checks.
Founder thesis
The market is real: Arcjet raised $8.3M and reports 500+ production apps, Unkey raised $4.5M, and Upstash sells the primitive at $0.20 per 100K commands. But every incumbent meters per app and per request, so developers turn protection off mid-incident when the meter spikes. I am betting a flat account price plus a written correctness contract wins the developers who got burned.
What others got wrong
Per-app fees plus per-request metering make abuse protection unaffordable exactly when it is working. One production developer disabled Arcjet after 100k bot requests in days.
Arcjet's bot-deny cache keys on IP alone, so a legitimate Safari request behind shared egress was denied as a bot for 60s, and maintainers closed the issue as not planned.
Upstash's cached fixed window loses one allowed request per window depending on cache state, and the fix sits in an unreviewed pull request.
Bundled platforms still meter steeply and gate team features: Zuplo charges $100 per additional 100K requests above 100K and puts SSO, RBAC and an SLA behind a $1,000/mo Enterprise floor.
What should work
Bill one flat account price and stop metering per app and per request. A rate-limit decision is a single counter operation, and Upstash already sells that at $0.20 per 100K commands with fixed plans that have no per-command pricing.
Run evaluation locally against the customer's own counter store, so the vendor's marginal cost is near zero and a flat monthly price survives.
Sell a written correctness contract: exactly-once accounting across cache hits, deterministic window boundaries, rejected requests that never mutate the counter, and shared-IP bot decisions that never apply to a different fingerprint without a re-check. The open issues and pull requests document these exact failures in incumbents.
Add per-agent and per-tool budgets for AI workloads, which Arcjet is already moving toward with its agent guards.
What kills it
- The wedge is a feature upgrade on top of shipped products, not a new category: Arcjet already runs in-code and ships agent guards.
- Upstash gives the core library away under MIT and sells fixed plans with no per-command pricing, so a flat price is easy to match.
- The correctness failures sit in open, unmerged pull requests, not in angry buyer threads, so demand for a fix is unproven at the level of dollars.
- No buyer complaint about per-app pricing specifically turned up; that gap is read off pricing pages.
What users want
4Abuse protection that does not bankrupt me when bot traffic spikes.
A developer running his own analytics tracker wrote on Hacker News: 'Added Arcjet, hit 100k bot requests in days, disabled it before it bankrupted me.'
No false bot denies for real users behind shared IPs.
A developer reported that an iMessage link preview from a shared egress (iCloud Private Relay or CGNAT) was denied for 60s, then a normal Safari request from the same IP was denied as a bot, and maintainers closed it as not planned.
A limit that does not silently drop a request depending on cache state.
The author of an open pull request on upstash/ratelimit-js wrote that callers systematically lose one allowed request per window whenever the counter stays hot.
A rejected request that does not still consume tokens and pin an identifier for months.
The author of another open pull request wrote that a rejected request leaves the bucket at -3, and that a 10s bucket can end up with a roughly 115-day expiry.
- Sources
- 19
- Checked
- 19
- Competitors
- 4
- Gaps
- 7
- Page checked
- 19 · 100%
- Snippet only
- 0 · 0%
- Documented
- 10 · 77%
- Interpreted
- 3 · 23%
- complaint6
- pricing4
- market4
- revenue3
- playbook2
Competitors
4Parsed from public pricing blurbs (entry paid tier when available). Max in set: $25/mo.
| Competitor | From | Free tier | Source |
|---|---|---|---|
| Arcjet | $25/mo | Yes | arcjet.com✓ |
| Unkey | Free | Yes | unkey.com✓ |
| Zuplo | Free | Yes | zuplo.com✓ |
| Upstash (Redis backing rate limits) | Free | Yes | upstash.com✓ |
What customers complain about
7| Gap | Src |
|---|---|
Per-request metering on top of a per-app fee makes abuse protection unaffordable exactly when it is working, so developers switch it off mid-incident; one Hacker News commenter disabled Arcjet after 100k bot requests in days. | |
A bot-deny cache keyed only by IP denies legitimate traffic from shared egress: an iMessage link preview behind iCloud Private Relay or CGNAT was denied for 60s, and a normal Safari request from the same IP was then denied as a bot without re-checking its User-Agent. Maintainers closed the issue as not planned. | |
A cached fixed window can allow one fewer request than the plan states: with limit=10, the request that raises the counter to 10 succeeds on a cache miss but is rejected from the local cache. Reported in an open, unreviewed pull request. | |
A token bucket can consume tokens on a rejected request and pin an identifier for months: with 2 tokens left a request fails but leaves the bucket at -3, and a large rate can push a 10s bucket to a roughly 115-day expiry. Reported in an open, unreviewed pull request. | |
A blocking helper can hammer the backing store when a reset timestamp is already in the past: negative delay is clamped to about 1ms, so the loop re-polls Redis for the full timeout, a write per poll with analytics on. Reported in an open, unreviewed pull request. | |
Charging per application means a solo developer with 3 small production apps on Arcjet Startup pays 3 x $299 = $897/mo plus $5 per 1M requests, on a plan that includes only 2 team members; even Individual is $25/mo per app. Whether buyers leave over this is a guess. | |
Bundled platforms still meter steeply and gate team features: Zuplo's Builder plan is 'not for teams' and overage is $100 per additional 100K requests, or $1,000 per 1M, while SSO, RBAC, audit logs and an SLA need Enterprise from $1,000/mo. Unkey's cheapest Pro tier is $25/mo for 250K valid requests, or $100 per 1M. |
Documented Interpreted
How competitors find customers
3| Tactic | Src |
|---|---|
| Open-source the platform and monetize a deeper tier: Unkey's public repo carries 5,440 stars and 636 forks, and the company says thousands of developers use it for auth, rate limiting and usage tracking, before raising a $4.5M seed. | unkey.com✓ |
| Agent-first free provisioning plus a free MIT client library: Upstash lets an agent create a Redis database with POST https://upstash.com/start-redis and no signup, deletes it after 3 days unless claimed, and ships the MIT ratelimit-js library with 2,044 stars that needs Upstash Redis. | upstash.com✓ |
| SDK-in-code plus framework and agent content rather than Hacker News launches: Arcjet publishes 'Guards: security inside the agent loop' and 'Agent Runtime Security' and reports 1,000+ developers across 500+ production apps, while its own company posts on Hacker News drew only 1-2 points each, so Hacker News is not the channel. | hn.algolia.com✓ |
Your angle & pricing wedge
| Piece | Claim | Src |
|---|---|---|
| Angle | An in-code rate-limit, quota and bot-protection SDK with a written correctness contract: exactly-once accounting across cache hits, deterministic window boundaries, rejected requests that never mutate the counter, and shared-IP bot decisions that never apply to a different fingerprint without a re-check. Add per-agent and per-tool budgets for AI workloads, and one flat account price for unlimited apps, seats and checks. | |
| Wedge | Bill one flat account price and stop metering per app and per request. A rate-limit decision is one counter operation, and Upstash openly sells that primitive at $0.20 per 100K commands with fixed plans that have no per-command pricing, so at $39/mo for unlimited apps and up to 50M local evaluations you land near $0.78 per 1M, against Arcjet's $5 per 1M plus $25 to $799 per app, Zuplo's $1,000 per 1M above 100K, and Unkey's $100/mo at 2M valid requests, and because evaluation runs locally on the customer's own store the vendor's marginal cost is near zero, though this compares each vendor's priciest setup and Upstash already makes the primitive cheap, so incumbents can match it. |
How others got traction
4| Move | Why | Src |
|---|---|---|
| Arcjet pushed protection from the network edge into application code and announced an $8.3M Series A alongside a local AI security model, then extended the idea to agent runtime security and guards inside the agent loop. | Founder David Mytton wrote that legacy network-edge tools see packets, not users or business logic and that running detection locally means millisecond decisions with first-party context, and the same post carries the $8.3M raise, though it does not show the in-code approach caused the funding. | blog.arcjet.com✓ |
| Unkey open-sourced its API key and rate-limit platform, now 5,440 stars and 636 forks, then raised a $4.5M seed led by Uncork Capital in April 2026. | The seed post says thousands of developers use the open platform for auth, rate limiting and usage tracking, but no MRR or paid-conversion figure is published, so the funnel's efficiency is unproven. | unkey.com✓ |
| Upstash gives away the rate-limit client library under MIT, 2,044 stars and 52 forks, and backs it with paid Redis, and now hands agents free no-signup Redis databases to seed accounts. | The homepage and pricing page state every product has a free tier and that pay-as-you-go billing is per request or command, and a database created with POST https://upstash.com/start-redis is deleted after 3 days unless claimed, but no conversion metric is published. | upstash.com✓ |
| Zuplo bundles rate limiting, API key management, a developer portal and MCP and AI gateways on every plan and positions itself as a cheaper replacement for Kong, Apigee and AWS API Gateway. | The pricing page says MCP Gateway, AI Gateway and the developer portal are included in every plan and claims most teams cut gateway spend by 40-70% in the first quarter, quoting a customer saving over 70%, but that 40-70% figure is a vendor sales claim, not audited, and Zuplo's own overage of $100 per additional 100K requests is among the most expensive in this set. | zuplo.com✓ |
Market heat
Arcjet raised an $8.3M Series A led by Plural with a16z and Seedcamp participating, after reporting more than 1,000 developers and 500+ production applications processing millions of requests daily. Company-reported.
More ▾Unkey raised a $4.5M seed led by Uncork Capital in April 2026, company-reported, and its open-source platform repo shows 5,440 stars and 636 forks.
Upstash sells rate-limit-adjacent Redis commands at $0.20 per 100K commands, with fixed plans from $10/mo and no per-command pricing, and its MIT rate-limit library has 2,044 stars.
More ▾Rate limiting draws recurring developer interest on Hacker News: 'Visualizing algorithms for rate limiting' scored 390 points and 49 comments, and 'An Alternative Approach to Rate Limiting' scored 226 points and 68 comments.
More ▾A production developer reports abandoning Arcjet over usage cost after bot traffic spiked: 'Added Arcjet, hit 100k bot requests in days, disabled it before it bankrupted me.'
More ▾
Revenue signals
4| Signal | Src |
|---|---|
Arcjet: $8.3M Series A led by Plural with a16z and Seedcamp participating, and more than 1,000 developers across more than 500 production applications processing millions of requests daily. Company-reported, not audited, and no MRR or ARR is disclosed. | blog.arcjet.com✓ |
Unkey: a $1.5M pre-seed announced November 2023 and a $4.5M seed led by Uncork Capital announced April 2026. Company-reported; thousands of developers is a company claim and no revenue, MRR or paid-customer count is published. | unkey.com✓ |
Upstash: no revenue or customer count is published. Pricing is per command, with fixed plans from $10/mo, so unit economics are visible but revenue is not. | upstash.com✓ |
Category self-serve entry: Arcjet Individual is $25/mo per app with no free-forever tier, only a 15-day trial and OSS eligibility; Unkey gives 150K valid requests free, Zuplo 100K requests free, Upstash 500K commands free. Whether enough buyers will pay a flat $39/mo for unlimited apps and checks rather than stay free or self-host the MIT library is unproven. | arcjet.com✓ |
Should you build this?
The category monetizes and the pain is real, but the wedge is crowded and half the differentiators already ship: Arcjet raised $8.3M and reports 500+ production apps, Unkey raised $4.5M on a repo with 5,440 stars, Upstash charges $0.20 per 100K commands with fixed plans from $10/mo, and Zuplo sells a bundled gateway from $25/mo to $1,000/mo and up. The complaints are specific: a production developer disabled Arcjet after bot traffic made the per-request meter untenable, a shared-IP bot-deny cache denied a legitimate Safari request behind iCloud Private Relay or CGNAT and maintainers closed it as not planned, and three open upstash/ratelimit-js pull requests report a cached fixed window that loses one allowed request per window, a rejected token-bucket request that still consumed tokens and could pin a key for roughly 115 days, and a blockUntilReady that can write to Redis on every poll. But the core is commoditized, Upstash's library is MIT with 2,044 stars and Arcjet's SDK is Apache-2.0 with 683 stars, so a correctness contract is a genuine selling point and also a copyable one. Test first: recruit 20 developers who already pay Arcjet, Unkey or Zuplo and run metered traffic, get their last 3 monthly bills with request volume, one logged incident where a limit misfired, and their exact current monthly cost, then offer a paid pre-order at $39/mo flat for unlimited apps, seats and local evaluations. Kill it if fewer than 5 of 20 can produce a real misfire, if the median current spend is under $25/mo, or if they would rather keep the free MIT Upstash library and self-host.
More ▾
All sources
19| Source | Kind | Status | Accessed |
|---|---|---|---|
| pricing | page checked | 2026-09-18 | |
| pricing | page checked | 2026-09-18 | |
| pricing | page checked | 2026-09-18 | |
| pricing | page checked | 2026-09-18 | |
| complaint | page checked | 2026-09-18 | |
| complaint | page checked | 2026-09-18 | |
| complaint | page checked | 2026-09-18 | |
| complaint | page checked | 2026-09-18 | |
| complaint | page checked | 2026-09-18 | |
| complaint | page checked | 2026-09-18 | |
| market | page checked | 2026-09-18 | |
| market | page checked | 2026-09-18 | |
| market | page checked | 2026-09-18 | |
| revenue | page checked | 2026-09-18 | |
| revenue | page checked | 2026-09-18 | |
| market | page checked | 2026-09-18 | |
| revenue | page checked | 2026-09-18 | |
| playbook | page checked | 2026-09-18 | |
| playbook | page checked | 2026-09-18 |