# Limit Req Configuration The `limit-req` plugin enforces API rate limiting with a leaky bucket algorithm to rate limit requests, enabling effective throttling to manage traffic flow. Configuration covers plugin parameters. ## Parameters[​](#parameters "Direct link to Parameters") See plugin [common configurations](https://docs.api7.ai/apisix/reference/plugin-common-configurations.md) for configuration options available to all plugins. * rate number required vaild vaule: greater than 0 *** The request rate allowed per second. Requests that exceed this rate consume the configured `burst` capacity and are delayed unless `nodelay` is true. * burst number required vaild vaule: greater than or equal to 0 *** The capacity for excessive requests above `rate`. Requests within this capacity are delayed unless `nodelay` is true; requests that exceed the capacity are rejected. This value is measured in requests, not requests per second. * key\_type string default: `var` vaild vaule: `var` or `var_combination` *** The type of key. If the `key_type` is `var`, the `key` is interpreted as a variable. If the `key_type` is `var_combination`, the `key` is interpreted as a combination of variables. * key string required *** The key to count requests by. If the `key_type` is `var`, the `key` is interpreted as a variable. The variable does not need to be prefixed by a dollar sign (`$`). See [built-in variables](https://docs.api7.ai/apisix/reference/built-in-variables.md) for available variables. If the `key_type` is `var_combination`, the `key` is interpreted as a combination of variables. All variables should be prefixed by dollar signs (`$`). For example, to configure the `key` to use a combination of two request headers `custom-a` and `custom-b`, the `key` should be configured as `$http_custom_a $http_custom_b`. * rejected\_code integer default: `503` vaild vaule: between 200 and 599 inclusive *** The HTTP status code returned when a request is rejected for exceeding the threshold. * rejected\_msg string vaild vaule: any non-empty string *** The response body returned when a request is rejected for exceeding the threshold. * nodelay boolean default: `false` *** If true, do not delay requests within the burst threshold. * allow\_degradation boolean default: `false` *** If true, allow the gateway to continue handling requests without the plugin when the plugin or its dependencies become unavailable. * policy string default: `local` vaild vaule: `local`, `redis`, or `redis-cluster` *** The policy for rate limiting counter. Required for API7 Enterprise (from 3.9.0) and optional for APISIX. When set to `local`, the counter is stored in memory locally. When set to `redis`, the counter is stored on a Redis instance. When set to `redis-cluster`, the counter is stored in a Redis cluster. * redis\_host string *** The address of the Redis node. Required when `policy` is `redis`. * redis\_port integer default: `6379` vaild vaule: greater than or equal to 1 *** The port of the Redis node when `policy` is `redis`. * redis\_username string *** The username for Redis if Redis ACL is used. If you use the legacy authentication method `requirepass`, configure only the `redis_password`. Used when `policy` is `redis`. * redis\_password string *** The password of the Redis node when `policy` is `redis` or `redis-cluster`. The password is encrypted at rest in API7 Enterprise. In APISIX, [enable data encryption](https://docs.api7.ai/apisix/production/security/data-encryption-with-keyring.md) to encrypt it before etcd storage. Encryption was introduced in API7 Enterprise 3.9.16 and 3.10.2, and APISIX 3.18.0. * redis\_database integer default: `0` vaild vaule: greater than or equal to 0 *** The database number in Redis when `policy` is `redis`. * redis\_ssl boolean default: `false` *** If true, use SSL to connect to Redis when `policy` is `redis`. * redis\_ssl\_verify boolean default: `false` *** If true, verify the server SSL certificate when `policy` is `redis`. * redis\_server\_name string *** TLS server name used for SNI and, when certificate verification is enabled, hostname verification. Applies when `policy` is `redis` and `redis_ssl` is `true`. Defaults to `redis_host`. If the selected value is an IP address, no server name is sent. To verify a DNS-named certificate when connecting by IP, set this field to the certificate's DNS name and enable `redis_ssl_verify`. Introduced in API7 Enterprise 3.9.21 and 3.10.8, and in APISIX 3.19.0. This field applies to the single-node Redis connector, not Redis Cluster or Sentinel. * redis\_timeout integer default: `1000` vaild vaule: greater than or equal to 1 *** The Redis timeout value in milliseconds when `policy` is `redis` or `redis-cluster`. * redis\_keepalive\_timeout integer default: `10000` vaild vaule: greater than or equal to 1000 *** Keepalive timeout in milliseconds for Redis when `policy` is `redis` or `redis-cluster`. This parameter is available in API7 Enterprise from version 3.9.17 on the 3.9 line and from version 3.10.4 on the 3.10 line, and in APISIX from version 3.15.0. * redis\_keepalive\_pool integer default: `100` vaild vaule: greater than or equal to 1 *** Keepalive pool size for Redis when `policy` is `redis` or `redis-cluster`. This parameter is available in API7 Enterprise from version 3.9.17 on the 3.9 line and from version 3.10.4 on the 3.10 line, and in APISIX from version 3.15.0. * redis\_cluster\_nodes array\[string] *** The list of Redis cluster nodes with at least one address. Required when `policy` is `redis-cluster`. * redis\_cluster\_name string *** The name of the Redis cluster. Required when `policy` is `redis-cluster`. * redis\_cluster\_ssl boolean default: `false` *** If true, use SSL to connect to Redis cluster when `policy` is `redis-cluster`. * redis\_cluster\_ssl\_verify boolean default: `false` *** If true, verify the server SSL certificate when `policy` is `redis-cluster`.