Firewall

The firewall watches how fast each IP is calling your API and, past the threshold, blocks it at the Cloudflare edge — so the traffic stops before it reaches your Worker and costs you anything.

1apiker.init({
2  routes,
3  exports,
4  objects: ["Common", "RateLimit", "Bans"],
5  firewall: { limitRequestsPerMinute: 120 }
6});

Passing firewall: true uses the default of 100 requests per minute.

What happens at the threshold

The caller is banned locally, so the next request is refused immediately.
The raw IP is submitted to the Cloudflare WAF as a block rule.
The request is answered with 429.

Admins are exempt, so an automated sweep from your own dashboard cannot lock you out.

Credentials

Edge blocking calls the Cloudflare API and needs CLOUDFLARE_WAF_KEY in the environment. Without it the WAF call cannot be made, and only the local ban applies.

Managing rules yourself

import { firewallBanIP, firewallUnbanIP, getFirewallBannedEntryId } from "apiker";

await firewallBanIP("203.0.113.10");
const entryId = await getFirewallBannedEntryId("203.0.113.10");
await firewallUnbanIP("203.0.113.10");

The firewall builds on rate limiting and bans, so include both RateLimit and Bans in objects.