> ## Documentation Index
> Fetch the complete documentation index at: https://docs.golf.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Rate Limiting

> Throttle MCP traffic with per-user, per-server, and global rate limits to prevent abuse and protect upstreams.

Golf Gateway rate limits MCP traffic using a Redis-backed sliding window. Limits are enforced in layers — per-user, per-server, and system-wide — so you can protect individual upstreams and the gateway as a whole from abuse or runaway clients.

## Prerequisites

* Golf Gateway deployed and running
* Redis configured

## How it works

Each request is checked against the limits in order, from most specific to most general:

1. **Per-user** — requests per window for a single authenticated user. Anonymous requests fall back to a **per-IP** limit using the same threshold.
2. **Per-server** — requests per window for a single user against a specific MCP server.
3. **Global** — system-wide requests per window across all users.

The first limit that is exceeded stops the request. Each layer uses the same sliding-window algorithm over the configured `window_seconds`.

<Note>
  Rate limiting **fails open**: if Redis is unavailable, requests are allowed through rather than blocked, so a cache outage never takes down your gateway.
</Note>

## Configure the per-user limit

The per-user limit is the only limit configurable via environment variables or YAML. Set it with the `GOLF_RATE_LIMIT_` variables:

```bash theme={null}
GOLF_RATE_LIMIT_ENABLED=true
GOLF_RATE_LIMIT_REQUESTS_PER_MINUTE=1000   # per-user limit, range 1-5000
GOLF_RATE_LIMIT_WINDOW_SECONDS=60          # sliding window, range 10-300
```

Or in YAML (Distributed mode), under the `security` section:

```yaml golf-gateway.yaml theme={null}
security:
  rate_limiting:
    enabled: true
    requests_per_minute: 1000
    window_seconds: 60
```

| Setting               | Env Variable                          | Default | Range  | Description                          |
| --------------------- | ------------------------------------- | ------- | ------ | ------------------------------------ |
| `enabled`             | `GOLF_RATE_LIMIT_ENABLED`             | `true`  | -      | Enable rate limiting                 |
| `requests_per_minute` | `GOLF_RATE_LIMIT_REQUESTS_PER_MINUTE` | `1000`  | 1-5000 | Per-user (and per-IP fallback) limit |
| `window_seconds`      | `GOLF_RATE_LIMIT_WINDOW_SECONDS`      | `60`    | 10-300 | Sliding window duration              |

## Global and per-server limits

System-wide (**global**) and **per-server** limits are managed through the **Control Plane** in Centralized mode — they are not configurable via environment variables or YAML. Their defaults are:

| Limit      | Default           | Configured via                  |
| ---------- | ----------------- | ------------------------------- |
| Per-user   | `1000` req/window | Env var, YAML, or Control Plane |
| Per-server | `500` req/window  | Control Plane only              |
| Global     | `1000` req/window | Control Plane only              |

<Info>
  All three limits share the same `window_seconds`. The window is always read from the environment and is not overridden by Control Plane configuration.
</Info>

## Related guides

* [Set Up Metrics and Monitoring](/gateway/guides/operations/setup-monitoring) - Monitor gateway health
* [Set Up Alerting](/gateway/guides/operations/setup-alerting) - Alert on anomalies
* [Environment Variables](/gateway/reference/environment-variables) - Full configuration reference
* [YAML Config Schema](/gateway/reference/yaml-schema) - Distributed mode configuration