API Rate Limiting for Low-Code Services with Redis - n8n Workflow

• Developers building microservices or low-code APIs.


• Technical users needing to protect expensive or limited backend resources (like Airtable, databases, or third-party APIs).


• Automation specialists looking for advanced infrastructure n8n templates.


• Anyone wanting to learn how to integrate Redis persistence into an n8n workflow.

When exposing data or actions via a public webhook, implementing robust security and rate limits is essential to prevent abuse and control costs. This specialized n8n workflow provides a dual-layer rate limiting mechanism, managing usage both per minute and per hour using Redis as a highly efficient counter store.

This particular n8n workflow uses an API key supplied in the request header (x-api-key) to uniquely track user requests. If a user exceeds 10 requests per minute OR 60 requests per hour, the n8n node structure automatically halts the process and returns an error message, preventing access to the protected resource (in this case, an Airtable database lookup). This is a highly effective way to manage traffic using native n8n node functionality combined with external infrastructure tools, resulting in secure and scalable n8n templates.

This n8n workflow is initiated by an external API call using the Webhook1 n8n trigger.

1. Request Initiation: The n8n trigger Webhook1 receives an HTTP request, expecting an API key via the x-api-key header for authentication and tracking.


2. Per-Minute Key Generation: The first Set n8n node generates a unique Redis key by combining the API key, the current hour, and the current minute. This ensures granularity.


3. Minute Limit Check: The first Redis n8n node increments the counter for the per-minute key and sets a TTL of 3600 seconds. The subsequent Per minute If n8n node checks if the count is less than or equal to 10.


4. Minute Rejection: If the limit is exceeded, the flow moves to the Set3 n8n node, which immediately returns a 'limit exceeded' message via the n8n workflow response mechanism.


5. Per-Hour Key Generation: If the minute check passes, the Set2 n8n node generates a broader per-hour key (API key + Hour).


6. Hour Limit Check: The Redis1 n8n node increments the per-hour counter. The Per hour If n8n node checks if this count is less than 60.


7. Hour Rejection: If the hourly limit is exceeded, the flow proceeds to Set1, returning the 'limit exceeded' message.


8. Success and Data Retrieval: If both rate limits pass, the n8n workflow proceeds to the Airtable n8n node to fetch the requested data. The final Function n8n node processes this data, formats it, and includes the current hourly usage count before sending the successful response back to the user.

1. Import: Copy the provided JSON data and import it as a new n8n workflow in your self-hosted or cloud n8n instance.


2. Redis Credentials: Configure the 'Redis Cloud Credentials' used by the Redis and Redis1 n8n nodes. This requires access to a running Redis instance.


3. Airtable Credentials: Configure the 'Airtable Credentials @n8n' credential used by the Airtable n8n node, ensuring it has read access to the specified 'Pokemon' table (or modify the Airtable node parameters to match your protected resource).


4. Webhook Setup: Note the URL of the Webhook1 n8n trigger. You will use this URL to make API calls, passing your unique API key in the x-api-key header.


5. Activation: Ensure the n8n workflow is active (toggled on) to begin processing requests.

Webhook1 (n8n Trigger): The starting point of the n8n workflow. It is configured with Header Authentication to protect the endpoint and ensures the user provides an API key.
Set & Set2 (n8n node): These nodes are crucial for defining the unique rate limit keys. Set creates the minute-based key (API Key-Hour-Minute), while Set2 creates the broader hour-based key (API Key-Hour), ensuring accurate time-based tracking.
Redis & Redis1 (n8n node): These nodes connect to the Redis service to manage counters using the incr operation. This provides atomic counting necessary for reliable rate limiting in this n8n template.
Per minute & Per hour (If n8n node): These core logic nodes determine whether the incoming request exceeds the threshold (10/minute and 60/hour). They control the branching flow of the n8n workflow.
Airtable (n8n node): The protected resource. This node executes a 'list' operation, which is only reached if both rate limits are respected.
Function (n8n node): Used for transforming the successful Airtable response into a clean JSON structure and including the current usage count for transparency.