# coss.com vs Unkey (https://coss.com/compare/unkey)

> Unkey has per-user overrides and regional counters. coss.com's limiter keeps named buckets with a separate burst, on your coss.com API key.

Both are hosted: you make an HTTP call with an identifier and get back whether to let the request through, with no Redis of your own. Unkey's standalone API takes the limit in each request, counts in a sliding window per region, and comes with overrides and API key management. coss.com's limiter keeps named buckets in one store, using GCRA with a separate burst, and is part of your plan next to Risk.

Facts about Unkey checked on 2026-11-03 against the sources listed below.

## At a glance

| | coss.com | Unkey |
| --- | --- | --- |
| Price | No per-check price: part of every coss.com plan | Free: 150,000 valid requests a month. Pro: $25 a month for 250,000, up to $1,000 for 100,000,000; over-limit checks aren't billed (One quota, shared with key verifications) |
| Rate of checks | 500 per second per API key, bursts of 1,000 | — (No figure in Unkey's docs) |
| How a limit is set | A named bucket, created once in the dashboard or the API; each check names the bucket and a key | limit and duration sent with every request; the namespace is created on first use |
| Changing a limit | Update the bucket, and the next check uses it | Change the code, or add an override, which takes about a minute to apply |
| Limits per customer | One rule per bucket: make a bucket per tier, up to 100 per environment | Overrides per identifier or wildcard pattern (*@acme.com) |
| Algorithm | GCRA, with a burst set apart from the steady rate | Sliding window; remaining is a close estimate |
| Period | 1 second to 1 day | 1 second to 30 days |
| Cost per check | 1 or more tokens | 0 or more: 0 reads without counting |
| Several limits at once | — | multiLimit: up to 100 checks, none counted if any fails (coss.com checks one bucket per call) |
| Where it counts | One central store: every check sees the same count, and checks far from it take longer | Regional counters that share counts within moments; a short burst can pass while traffic is split across regions |
| Repeat offenders | Every check is a request | The TypeScript SDK answers blocked identifiers from memory until reset |
| When it can't count | on_failure per bucket: allow (default) or deny, with degraded: true. If the API can't be reached, your code decides | The API returns an error and your code decides; the TypeScript SDK denies after 5 seconds unless you set a fallback |
| Retried checks | The SDK sends an Idempotency-Key, and a retried check is charged once | — (Not documented on Unkey's rate limiting pages) |
| What's recorded | A keyed hash of each key; a log line per request with the key redacted; no per-identifier analytics | Each check in rate limit analytics, with a query API; a header keeps a call out of them |
| Self-hosting | — | Source-available under FSL-1.1-ALv2, with self-hosting allowed |
| Also on the same account | Risk assessments, email, SMS, Verify, Forms, Hooks | API keys and identities, Compute |

## When Unkey is the better choice

- **You give some customers different limits.** An override changes one identifier or a wildcard pattern without a deploy, which suits per-customer deals. coss.com has one rule per bucket, so tiers mean separate buckets and code to pick one.
- **Your traffic is global.** Unkey decides in the region that sees the request. coss.com counts in one central store, so checks from far away take longer.
- **You check several limits per request.** multiLimit checks up to 100 limits in one call and counts none of them if any fails. With coss.com, that's one call per bucket, and each counts on its own.
- **You also issue API keys.** Unkey's keys and identities carry limits checked at verification. coss.com doesn't offer API keys for your own product.
- **You need windows longer than a day, or to run it yourself.** Unkey's durations go up to 30 days, and its code is source-available with self-hosting allowed. coss.com's periods stop at a day, and it's offered as a hosted service.

## When coss.com is the better choice

- **No meter.** Checks are part of every coss.com plan, so a limiter on a busy endpoint doesn't add a line to your bill.
- **Bursts as their own setting.** With limit: 10, period_seconds: 60 and burst: 30, a key can make 30 requests at once and then 10 a minute.
- **The numbers live outside your code.** Code names a bucket. Its limit, burst and failure mode are in the dashboard and the API, and the next check uses them, with no deploy.
- **Retries don't double-spend.** The SDK retries network errors with the same Idempotency-Key, so a flaky connection never spends a user's tokens twice.
- **Keys stay hashed.** coss.com keeps only a keyed hash of each key, so email addresses and IP addresses you limit by aren't stored.
- **Next to Risk.** A limit answers how often and an assessment answers who, on one API key: limit password resets per address, and assess sign-ups with velocity across your environment.

## Moving from Unkey

1. **Turn each limit into a bucket.** Each namespace, limit and duration you use becomes coss.risk.limitBuckets.create({ name, limit, period_seconds }). Durations go from milliseconds to seconds, up to a day, with on_failure set to what you want during an outage. (/docs/risk/rate-limits)
2. **Swap the check.** unkey.ratelimit.limit({ namespace, identifier, limit, duration }) becomes coss.risk.limit({ bucket, key, cost }). success becomes allowed, and reset (a timestamp) becomes reset_ms (from now), with retry_after_ms when denied. Counts start from zero. (/docs/risk/rate-limits)
3. **Replace overrides.** Overrides have no equivalent: make a bucket per tier and choose one by the customer's plan. multiLimit becomes one call per bucket. (/products/rate-limiting)

## Frequently asked questions

### Do I have to run Redis for either one?

No. Both count in their own store and answer over HTTP. A denied check is a 200 on both, so read allowed on coss.com and success on Unkey.

### What does coss.com's rate limiting cost?

It has no per-check price: it's part of every plan, up to 500 per second per API key, bursts of 1,000. Unkey meters standalone rate limit operations against a monthly quota shared with key verifications, and over-limit checks aren't billed.

### Does coss.com have overrides for individual customers?

No. A bucket has one rule for every key. Make one bucket per tier and pick it in your code. Unkey's overrides set a different limit per identifier or wildcard pattern.

### Is it as fast as a multi-region limiter?

Not everywhere. coss.com counts in one central store, so checks from far away take longer, and every check sees the same count. Unkey decides in each region and shares counts within moments, so a short burst can pass when traffic is split.

### What happens when the limiter is down?

On coss.com, each bucket's on_failure says whether to allow or deny while its store is down, and the answer has degraded: true. If the API itself can't be reached, the call fails and your code decides. On Unkey, the check returns an error and your code decides, and its TypeScript SDK has a fallback.

## Sources

- [Unkey pricing](https://www.unkey.com/pricing)
- [Unkey docs: rate limiting overview](https://www.unkey.com/docs/api-management/ratelimiting/overview.md)
- [Unkey docs: how rate limiting works](https://www.unkey.com/docs/api-management/ratelimiting/how-it-works.md)
- [Unkey docs: limit and multiLimit](https://www.unkey.com/docs/api-management/ratelimiting/limit-and-multi-limit.md)
- [Unkey docs: overrides](https://www.unkey.com/docs/api-management/ratelimiting/overrides.md)
- [Unkey docs: TypeScript SDK](https://www.unkey.com/docs/api-management/sdks/typescript/ratelimit.md)
- [Unkey docs: usage](https://www.unkey.com/docs/platform/billing/usage.md)
- [unkey on GitHub](https://github.com/unkeyed/unkey)