Best practice for Rate Limiting OTP-based auth?

[deadcoder0904]

I'm planning to use https://www.npmjs.com/package/rate-limiter-flexible with Redis.

I have a 6-digit alphanumeric OTP-based auth.

Curious, what's the best practice to stop or slow down brute-force attacks?

[deadcoder0904]

Found the answer on animir/node-rate-limiter-flexible#255 & their wiki has many examples. I need a simple solution so will mimick it close to the project below.

I made a project too with a simple Next.js example -> https://github.com/deadcoder0904/nextjs-rate-limit

Couldn't figure out how to rate-limit server actions (mostly just testing) so stuck to api routes in Next.js because I could test in development with node.js scripts -> https://github.com/deadcoder0904/nextjs-rate-limit/blob/main/src/automate-rate-limit/login.ts