I noticed that the free plan doesn't require an API key, that could be something that you may consider adding. In Cloudflare you could probably add a WAF rule for header, query string, or cookie values and if not set have CF reject the all.
If you mean a rate-limiter in the app, I already have it. The thing is the requests are keeping the web server busy.
But if you mean a rate-limiter on the CF itself then I can say not a use case for a business built based on rate-limit 😅
Adam Patterson
I noticed that the free plan doesn't require an API key, that could be something that you may consider adding. In Cloudflare you could probably add a WAF rule for header, query string, or cookie values and if not set have CF reject the all.