Protect your app from spam and abuse with rate limiting.
Upstash is your platform’s bouncer. It counts how often each person hits your app and blocks them when they go too fast.Without it, one bad actor could create thousands of fake accounts through your signup form, drain your monthly email allowance by hammering password resets, or slow your app down for real customers. Your app already knows how to enforce those limits, it just needs somewhere to keep the count, and that’s what you’re setting up here.This is the shortest chapter in the course.
You’ll land inside your account on the Vector product page, which isn’t what you need. Upstash sells several products and your app only uses Redis, so click Redis in the top navigation bar.
You land on Vector by default. Redis is the one your app uses.
The Redis page says no database has been created yet. Click the green + Create Database button on the right.
2
Configure it
Give it a clear name, such as Rate-limit-database.For Primary Region, select N. Virginia, USA (us-east-1). This is the same region your app runs in on Vercel and the same one you chose for Supabase, so every check your app makes stays inside one data centre instead of crossing the country and back. Your own location doesn’t matter here, only that these three services sit together.Turn Eviction on. It tells Upstash to drop the oldest entries if the database ever fills up, so your rate limiting keeps working instead of failing. Your entries expire on their own within minutes anyway, so this is a safety net that will rarely be needed and costs nothing to have.Click Next.
Region and eviction are the two settings that matter.
3
Choose the free plan
Select the Free plan and click Next.Rate limiting stores tiny entries that disappear within minutes, so the free tier is far more than your app will ever need here.
Check the summary and click Create.
Monthly $0, in the same region as the rest of your services.
You’ll land on your database’s Details page. Scroll to the Connect section and make sure you’re on the REST tab.You’ll see two values, UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN, which match two of the settings waiting in Vercel.
2
Copy the URL
Copy the value of UPSTASH_REDIS_REST_URL, taking only what’s inside the quotation marks.In Vercel, open your project’s Environment Variables, find UPSTASH_REDIS_REST_URL, click the three dots, click Edit, paste it and click Save.
3
Copy the token
Back in Upstash, the token is hidden by default. Click the eye icon at the top right of the code area to reveal it, then select the value inside the quotation marks and copy it.In Vercel, find UPSTASH_REDIS_REST_TOKEN, click the three dots, click Edit, paste it and click Save.
Unlike the URL, this token gives full read and write access to your database. Don’t share it, and don’t leave it revealed on screen if you’re recording or screenshotting.
The URL is on the first line, the token on the second, both inside the quotation marks.
Your app is protected against abuse. Next comes Twilio, the longest chapter in the course, where you set up the phone system that carries your customers’ calls.
