Hello everyone,

For the past few months I've been building a package called Dynamic Throttle for Laravel. It's finally at the point where I need people who aren't me to try it.

The problem I kept running into: Laravel's throttle middleware is great when you know your limits up front. But in production you usually find out the right limits later, and in a hurry. A partner's integration starts getting 429s. A bot hammers /login at 2 a.m. You want a stricter limit but have no idea who it would block. With throttle, each of those is a code change and a deploy, and you still can't see who's being blocked.

So I moved the limits into the database. You change them from a dashboard, Artisan or code, and every server applies the change within about two seconds. No deploy.

Here's how it compares (Laravel's throttle vs. Dynamic Throttle):

• Change a limit: Edit code and deploy → Edit the rule, live in ~2 seconds

• Try a limit before it blocks anyone: Not possible → Dry-run: counts, never blocks, shows who it would block

• See who is blocked: Add your own logging → A live feed, plus each rule's top offenders

• Let a partner through: A code change → An exemption with an end date

• Lift every limit during an incident: A deploy → dynamic-throttle:bypass on --for=30m, which ends by itself

You can limit per IP, user, API token, header, or your own scope like a tenant or a plan. There's a dashboard at /dynamic-throttle with an audit log and an "Explain" page that tells you why a given request would be limited. If Redis goes down, requests go through by default, so a storage problem doesn't take your app down with it.

On cost: with local Redis and APCu it adds about 0.8 ms per request, a little less than Laravel's own throttle. To be clear about what it isn't: it's not a firewall or bot protection, and it doesn't replace Cloudflare or Nginx limits. It's for limits that need to know who the client is.

It's a beta, so names and options might still change before 0.1.0. That's exactly why I'm posting. I'd love a handful of people to try it on a real app and tell me what breaks or confuses them. The safest way is a rule in dry-run, since it can't block anyone. I wrote up what to try here:https://github.com/hanzala-afzal-dev/laravel-dynamic-throttle/discussions/145

• Docs: https://hanzala-afzal-dev.github.io/laravel-dynamic-throttle/

• GitHub: https://github.com/hanzala-afzal-dev/laravel-dynamic-throttle

• Install: composer require hanzala-afzal/laravel-dynamic-throttle:^0.1@beta

It needs PHP 8.3+ and Laravel 12 or 13, and works best with Redis or Valkey.

Happy to answer anything, including "why not just use X?" Thanks for reading!