I do not understand why would I need JWTs here

OK. Imagine that i'm a hacker wanting to shut down your website and deny to all your users the ability to request anything.

How would i do that ? as your project is open source i can see that your APIs are not protected. So if i spam your server with requests, i will for sure encounter the limits that where granted to you via your API key.

So ONE user can deny access to your APIs to ALL your users.

To mitigate that, what you usually want is to only deny the spamming user access to your APIs. for this you need to give the user a unique id and require each user to access your API with this id.

• You can rate limit users based on their IP address (but if many different users are behind the same adress you will block all the legitimate users behind the adress),
• You can rate limit users based on a unique id for each user behind the same IP adress by giving them a distinct JWT. In server side you create an id for a user (with IP inside as payload for exemple) and sign it by encapsulating it in a JWT. You then just check that this JWT is valid, and you should also give this JWT an expiration time (5 minutes to 20 minutes might be a good idea). Note that you need to use asymetric algorithm (like RS256) to really protect an API with JWTs.

Using the user IP for starting is fine, so you are rigth, you don't need JWT, but for more fine grained propection i would use a JWT that combine IP/expiration date to protect you APIs.

Now for your API you can plug a rate limiter middleware, like this :github.com/animir/node-rate-limite...

• You can use a memory store instead of redis to not need another server.
• You can use a jwt instead of user ip to check access.