diff --git a/composer.json b/composer.json
index 2cb912b..850fa5e 100644
--- a/composer.json
+++ b/composer.json
@@ -70,7 +70,8 @@
   "extra": {
     "laravel": {
       "providers": [
-        "CSlant\\Blog\\Api\\Providers\\BlogApiServiceProvider"
+        "CSlant\\Blog\\Api\\Providers\\BlogApiServiceProvider",
+        "CSlant\\Blog\\Api\\Providers\\RouteServiceProvider"
       ]
     }
   },
diff --git a/config/blog-api.php b/config/blog-api.php
index 3d8509d..b987ae6 100644
--- a/config/blog-api.php
+++ b/config/blog-api.php
@@ -1,10 +1,8 @@
 <?php
 
-$routePrefix = env('BLOG_API_ROUTE_PREFIX', 'api');
-
 return [
     'defaults' => [
         /* Set route prefix for the blog API */
-        'route_prefix' => $routePrefix,
+        'route_prefix' => env('BLOG_API_ROUTE_PREFIX', 'api'),
     ],
 ];
diff --git a/phpstan-baseline.neon b/phpstan-baseline.neon
index da9ba7d..cbc5146 100644
--- a/phpstan-baseline.neon
+++ b/phpstan-baseline.neon
@@ -11,3 +11,6 @@ parameters:
 
         - message: '#Call to an undefined static method CSlant\\Blog\\Api\\Http\\Resources\\ListPostResource::collection\(\).#'
           path: src/Http/Controllers/PostController.php
+
+        - message: '#Cannot cast mixed to string#'
+          path: '*'
diff --git a/src/Providers/RouteServiceProvider.php b/src/Providers/RouteServiceProvider.php
new file mode 100644
index 0000000..c598964
--- /dev/null
+++ b/src/Providers/RouteServiceProvider.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace CSlant\Blog\ApiPackage\Providers;
+
+use CSlant\Blog\Core\Models\User;
+use Illuminate\Cache\RateLimiting\Limit;
+use Illuminate\Foundation\Support\Providers\RouteServiceProvider as ServiceProvider;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\RateLimiter;
+
+class RouteServiceProvider extends ServiceProvider
+{
+    /**
+     * Move base routes to a service provider to make sure all filters & actions can hook to base routes
+     */
+    public function boot(): void
+    {
+        // add rate limit for api
+        $this->configureRateLimiting();
+    }
+
+    protected function configureRateLimiting(): void
+    {
+        RateLimiter::for((string) config('blog-api.defaults.route_prefix'), function (Request $request) {
+            /** @var null|User $user */
+            $user = $request->user();
+            $identifier = $user ? $user->id : $request->ip();
+
+            return Limit::perMinute(40)->by($identifier);
+        });
+    }
+}