OptionalearlyBuild a rate-limit key before request parsing and context creation.
This is used for global and IP-scoped limits.
OptionalipResolve the client IP for ip-scoped limits.
There is no default: when any contract declares an ip-scoped rate limit
and neither trustedProxy.clientIp, ipSource, nor a custom earlyKey
is configured, the hook fails at startup. Prefer trustedProxy.clientIp
for production proxy headers; keep ipSource for custom keying or
compatibility, or pass "none" to explicitly accept one shared
ip:unknown bucket for all clients.
OptionalkeyBuild a rate-limit key after context exists.
This is used for user-scoped limits and any late key strategy.
OptionaltrustedShared trusted-proxy policy used to resolve client IPs when ipSource is
not set.
Configure this only when the app is always behind a platform or reverse
proxy that strips or normalizes forwarding headers. For ip-scoped rate
limits, set trustedProxy.clientIp to the header source written by that
trusted edge.
Options for
createRateLimitHooks(...).