How to Implement Redis-Backed Rate Limiting in Next.js App Router on Serverless

Rate limiting in Next.js App Router on serverless platforms like Vercel breaks in ways that in-memory solutions cannot handle, because each function instance maintains its own counter, effectively multiplying the configured limit by the number of warm instances. Next.js middleware, while efficient for blocking abusive traffic early, cannot distinguish between individual Server Actions since all of them POST to the same page URL. The only reliable way to rate-limit a specific Server Action is to embed the logic directly inside the action body using a shared Redis-backed store. Developers should use Vercel's ipAddress() helper for accurate client identification, as NextRequest.ip was removed in Next.js 15 and raw forwarded headers can be spoofed. When a limit is exceeded, returning a structured error value rather than throwing is recommended, since uncaught Server Action errors are redacted in production and give users no actionable information.