I made a small rate limiter for JS. It's about 1 KB, has no dependencies and runs on Node, Bun, Deno and Cloudflare Workers.

It uses GCRA, so each key is just one timestamp instead of a counter plus a timer. Nothing runs in the background. Keys you've already seen don't allocate either, since the timestamps live in a Float64Array.

import { limito } from 'limito'

const rl = limito({ limit: 100, window: '1m' })
const wait = rl('user:42') // 0 if allowed, otherwise ms to wait

There's also a Redis version for when you have multiple servers, and small middlewares for Express and Hono.

MIT licensed, still early (0.5). Feedback and bug reports welcome.