Do I have to run Redis for either one?

No. Both count in their own store and answer over HTTP. A denied check is a 200 on both, so read allowed on coss.com and success on Unkey.

What does coss.com's rate limiting cost?

It has no per-check price: it's part of every plan, up to 500 per second per API key, bursts of 1,000. Unkey meters standalone rate limit operations against a monthly quota shared with key verifications, and over-limit checks aren't billed.

Does coss.com have overrides for individual customers?

No. A bucket has one rule for every key. Make one bucket per tier and pick it in your code. Unkey's overrides set a different limit per identifier or wildcard pattern.

Is it as fast as a multi-region limiter?

Not everywhere. coss.com counts in one central store, so checks from far away take longer, and every check sees the same count. Unkey decides in each region and shares counts within moments, so a short burst can pass when traffic is split.

What happens when the limiter is down?

On coss.com, each bucket's on_failure says whether to allow or deny while its store is down, and the answer has degraded: true. If the API itself can't be reached, the call fails and your code decides. On Unkey, the check returns an error and your code decides, and its TypeScript SDK has a fallback.

coss.com vs Unkey

Unkey has per-user overrides and regional counters. coss.com's limiter keeps named buckets with a separate burst, on your coss.com API key.

Both are hosted: you make an HTTP call with an identifier and get back whether to let the request through, with no Redis of your own. Unkey's standalone API takes the limit in each request, counts in a sliding window per region, and comes with overrides and API key management. coss.com's limiter keeps named buckets in one store, using GCRA with a separate burst, and is part of your plan next to Risk.

At a glance

Unkey's side was checked on November 3, 2026 against its own pages. Prices are list prices.

Feature	coss.com	Unkey
PriceOne quota, shared with key verifications	No per-check price: part of every coss.com plan	Free: 150,000 valid requests a month. Pro: $25 a month for 250,000, up to $1,000 for 100,000,000; over-limit checks aren't billed
Rate of checksNo figure in Unkey's docs	500 per second per API key, bursts of 1,000	—
How a limit is set	A named bucket, created once in the dashboard or the API; each check names the bucket and a key	limit and duration sent with every request; the namespace is created on first use
Changing a limit	Update the bucket, and the next check uses it	Change the code, or add an override, which takes about a minute to apply
Limits per customer	One rule per bucket: make a bucket per tier, up to 100 per environment	Overrides per identifier or wildcard pattern (*@acme.com)
Algorithm	GCRA, with a burst set apart from the steady rate	Sliding window; remaining is a close estimate
Period	1 second to 1 day	1 second to 30 days
Cost per check	1 or more tokens	0 or more: 0 reads without counting
Several limits at oncecoss.com checks one bucket per call	—	multiLimit: up to 100 checks, none counted if any fails
Where it counts	One central store: every check sees the same count, and checks far from it take longer	Regional counters that share counts within moments; a short burst can pass while traffic is split across regions
Repeat offenders	Every check is a request	The TypeScript SDK answers blocked identifiers from memory until reset
When it can't count	on_failure per bucket: allow (default) or deny, with degraded: true. If the API can't be reached, your code decides	The API returns an error and your code decides; the TypeScript SDK denies after 5 seconds unless you set a fallback
Retried checksNot documented on Unkey's rate limiting pages	The SDK sends an Idempotency-Key, and a retried check is charged once	—
What's recorded	A keyed hash of each key; a log line per request with the key redacted; no per-identifier analytics	Each check in rate limit analytics, with a query API; a header keeps a call out of them
Self-hosting	—	Source-available under FSL-1.1-ALv2, with self-hosting allowed
Also on the same account	Risk assessments, email, SMS, Verify, Forms, Hooks	API keys and identities, Compute

Which to choose

Both are good at what they do. Here is where each one fits better.

Choose Unkey when

You give some customers different limits
An override changes one identifier or a wildcard pattern without a deploy, which suits per-customer deals. coss.com has one rule per bucket, so tiers mean separate buckets and code to pick one.
Your traffic is global
Unkey decides in the region that sees the request. coss.com counts in one central store, so checks from far away take longer.
You check several limits per request
multiLimit checks up to 100 limits in one call and counts none of them if any fails. With coss.com, that's one call per bucket, and each counts on its own.
You also issue API keys
Unkey's keys and identities carry limits checked at verification. coss.com doesn't offer API keys for your own product.
You need windows longer than a day, or to run it yourself
Unkey's durations go up to 30 days, and its code is source-available with self-hosting allowed. coss.com's periods stop at a day, and it's offered as a hosted service.

Choose coss.com when

No meter
Checks are part of every coss.com plan, so a limiter on a busy endpoint doesn't add a line to your bill.
Bursts as their own setting
With limit: 10, period_seconds: 60 and burst: 30, a key can make 30 requests at once and then 10 a minute.
The numbers live outside your code
Code names a bucket. Its limit, burst and failure mode are in the dashboard and the API, and the next check uses them, with no deploy.
Retries don't double-spend
The SDK retries network errors with the same Idempotency-Key, so a flaky connection never spends a user's tokens twice.
Keys stay hashed
coss.com keeps only a keyed hash of each key, so email addresses and IP addresses you limit by aren't stored.
Next to Risk
A limit answers how often and an assessment answers who, on one API key: limit password resets per address, and assess sign-ups with velocity across your environment.

Moving from Unkey

1
Turn each limit into a bucket
Each namespace, limit and duration you use becomes coss.risk.limitBuckets.create({ name, limit, period_seconds }). Durations go from milliseconds to seconds, up to a day, with on_failure set to what you want during an outage.
Read the guide
2
Swap the check
unkey.ratelimit.limit({ namespace, identifier, limit, duration }) becomes coss.risk.limit({ bucket, key, cost }). success becomes allowed, and reset (a timestamp) becomes reset_ms (from now), with retry_after_ms when denied. Counts start from zero.
Read the guide
3
Replace overrides
Overrides have no equivalent: make a bucket per tier and choose one by the customer's plan. multiLimit becomes one call per bucket.
Read the guide

Questions

Do I have to run Redis for either one?: No. Both count in their own store and answer over HTTP. A denied check is a 200 on both, so read allowed on coss.com and success on Unkey.
What does coss.com's rate limiting cost?: It has no per-check price: it's part of every plan, up to 500 per second per API key, bursts of 1,000. Unkey meters standalone rate limit operations against a monthly quota shared with key verifications, and over-limit checks aren't billed.
Does coss.com have overrides for individual customers?: No. A bucket has one rule for every key. Make one bucket per tier and pick it in your code. Unkey's overrides set a different limit per identifier or wildcard pattern.
Is it as fast as a multi-region limiter?: Not everywhere. coss.com counts in one central store, so checks from far away take longer, and every check sees the same count. Unkey decides in each region and shares counts within moments, so a short burst can pass when traffic is split.
What happens when the limiter is down?: On coss.com, each bucket's on_failure says whether to allow or deny while its store is down, and the answer has degraded: true. If the API itself can't be reached, the call fails and your code decides. On Unkey, the check returns an error and your code decides, and its TypeScript SDK has a fallback.

Sources

Unkey's facts were checked on November 3, 2026; their pages are the final word on their prices and features.

The coss.com side

Rate limitingcoss.com rate limiting is a hosted rate limiter for your own endpoints. Define buckets once and check any key, a user, email or IP, with one call.

Try coss.com next to Unkey.

A development key costs nothing and delivers nothing, so you can compare with real code.

Add coss.com to this project: read https://coss.com/llms.txt, get a development key with `npx coss-cli init --agents`, and build and test with it.