@@ -52,7 +52,7 @@ describe("upsertGithubLogin", () => {
 });
 
 // Rate-limit storage selection (2026-08-23 incident follow-up). The point of
-// these two: production must get the Durable-Object customStorage, and every
+// these two: production must get the binding-backed customStorage, and every
 // binding-less caller (tests, bare local envs) must still build without one.
 describe("rateLimit storage selection", () => {
   function env(overrides: Partial<AuthEnv> = {}): AuthEnv {
@@ -66,12 +66,11 @@ describe("rateLimit storage selection", () => {
     };
   }
 
-  it("uses the Durable-Object customStorage when RATE_LIMIT is bound", async () => {
-    const RATE_LIMIT = {
-      idFromName: (name: string) => name,
-      get: () => ({ consume: async () => ({ allowed: true, retryAfter: null }) }),
-    };
-    const auth = await createAuth(env({ RATE_LIMIT }));
+  const allow = { limit: async () => ({ success: true }) };
+  const limiters = { RL_SIGN_IN: allow, RL_EMAIL: allow, RL_OAUTH: allow, RL_DEFAULT: allow };
+
+  it("uses the binding-backed customStorage when the rate limiters are bound", async () => {
+    const auth = await createAuth(env(limiters));
     const rateLimit = auth?.options.rateLimit;
     expect(rateLimit?.enabled).toBe(true);
     expect(typeof rateLimit?.customStorage?.consume).toBe("function");
@@ -89,17 +88,18 @@ describe("rateLimit storage selection", () => {
 // End-to-end through Better Auth's own limiter, using a customStorage that
 // denies EVERYTHING. Anything that still answers non-429 is genuinely exempt.
 describe("rate limiting exemptions (live handler)", () => {
+  const deny = { limit: async () => ({ success: false }) };
   function denyAllEnv(): AuthEnv {
     return {
       DB: createFakeD1(),
       BETTER_AUTH_SECRET: "x".repeat(32),
       BETTER_AUTH_URL: "https://uploads.sh",
       WEB_ORIGIN: "https://uploads.sh",
       ENVIRONMENT: "production",
-      RATE_LIMIT: {
-        idFromName: (name: string) => name,
-        get: () => ({ consume: async () => ({ allowed: false, retryAfter: 30 }) }),
-      },
+      RL_SIGN_IN: deny,
+      RL_EMAIL: deny,
+      RL_OAUTH: deny,
+      RL_DEFAULT: deny,
     };
   }
 
@@ -138,7 +138,7 @@ describe("rate limiting exemptions (live handler)", () => {
       }),
     );
     expect(res.status).toBe(429);
-    expect(res.headers.get("X-Retry-After")).toBe("30");
+    expect(res.headers.get("X-Retry-After")).toBe("60");
   });
 });
 
 
@@ -58,7 +58,11 @@ import { hasProductUpdatesOptOut } from "./product-updates";
 import { reportHandledError } from "@uploads/observability";
 import { setIssueContext } from "@uploads/observability/issues";
 import { buildTokenGrantAfterHandler, captureRefreshTokenPriorState } from "./oauth-observability";
-import { createDurableRateLimitStorage, type RateLimitNamespaceLike } from "./rate-limit";
+import {
+  createBindingRateLimitStorage,
+  rateLimitTiers,
+  type RateLimitBindings,
+} from "./rate-limit";
 import * as schema from "./schema";
 import { stripePluginOrNone } from "./stripe-plugin";
 import { authTrustedOrigins, isTrustedOrigin } from "./trusted-origins";
@@ -523,7 +527,8 @@ async function enforceLastAdminGuard(
 }
 
 export type AuthEnv = GitHubCredentialsEnv &
-  DashApiKeyEnv & {
+  DashApiKeyEnv &
+  RateLimitBindings & {
     DB: D1Database;
     EMAIL?: import("./email").EmailBinding;
     BETTER_AUTH_URL?: string;
@@ -536,11 +541,6 @@ export type AuthEnv = GitHubCredentialsEnv &
     ENVIRONMENT?: string;
     BETTER_AUTH_TRUSTED_ORIGINS?: string;
     AUTH_RATE_LIMIT_DISABLED?: string;
-    /**
-     * Durable Object namespace backing the rate limiter (src/rate-limit-do.ts).
-     * Without it, Better Auth's in-memory storage is used.
-     */
-    RATE_LIMIT?: RateLimitNamespaceLike;
     /** Ephemeral flag passed only by `pnpm dev:stack`; never configure in prod. */
     LOCAL_STACK?: string;
     /** Gates stripePluginOrNone and feeds the memoization key. */
@@ -557,15 +557,16 @@ export type AuthEnv = GitHubCredentialsEnv &
 export type BetterAuthInstance = ReturnType<typeof buildAuth>;
 
 /**
- * Rate-limit storage: the Durable Object when RATE_LIMIT is bound, Better
+ * Rate-limit storage: the Rate Limiting bindings when all are bound, Better
  * Auth's in-memory Map otherwise. Both branches return the same shape so
  * callers don't have to narrow a union.
  */
 function rateLimitStorage(env: AuthEnv): {
-  customStorage?: ReturnType<typeof createDurableRateLimitStorage>;
+  customStorage?: ReturnType<typeof createBindingRateLimitStorage>;
   storage?: "memory";
 } {
-  if (env.RATE_LIMIT) return { customStorage: createDurableRateLimitStorage(env.RATE_LIMIT) };
+  const tiers = rateLimitTiers(env);
+  if (tiers) return { customStorage: createBindingRateLimitStorage(tiers) };
   return { storage: "memory" };
 }
 
@@ -1035,13 +1036,12 @@ function buildAuth(
     //
     // D1 is kept out of the rate-limit path: a D1 stall once hung every
     // /api/auth/* request. /get-session is exempt entirely (customRules), and
-    // the remaining low-frequency endpoints use one Durable Object counter
-    // per key (src/rate-limit-do.ts), an exact fleet-wide fixed window. The
-    // wrapper fails open and races the DO call against a ~1.5s timer, since
-    // rate limiting is abuse-shaping, not a security boundary.
+    // the remaining endpoints use the per-colo Rate Limiting bindings
+    // (src/rate-limit.ts). The wrapper fails open, since rate limiting is
+    // abuse-shaping, not a security boundary.
     //
-    // Without the binding (tests, bare local envs) Better Auth's in-memory
-    // Map is used. KV is too coarse (1 write/sec/key) for a shared counter.
+    // Without the bindings (tests, bare local envs) Better Auth's in-memory
+    // Map is used.
     rateLimit: {
       enabled: isProduction && env.AUTH_RATE_LIMIT_DISABLED !== "true",
       ...rateLimitStorage(env),
@@ -1103,9 +1103,9 @@ function cacheKey(
     githubClientSecret: github?.clientSecret ?? null,
     dashApiKey,
     hasEmail: Boolean(env.EMAIL),
-    // Presence flips the limiter between DO-backed customStorage and Better
-    // Auth's memory fallback, so it has to be part of the key.
-    hasRateLimitDO: Boolean(env.RATE_LIMIT),
+    // Presence flips the limiter between binding-backed customStorage and
+    // Better Auth's memory fallback, so it has to be part of the key.
+    hasRateLimiters: Boolean(rateLimitTiers(env)),
   });
 }
 
 
@@ -17,12 +17,6 @@ import * as schema from "./schema";
 import { billingPricesResponseBody } from "./billing-prices";
 import { ROBOTS_TXT } from "./robots";
 
-// Durable Object backing Better Auth's rate limiter (see src/rate-limit-do.ts
-// and the `durable_objects` block in wrangler.jsonc). Wrangler resolves the
-// binding's class_name against the entrypoint's named exports, so this
-// re-export is load-bearing even though nothing in this file calls it.
-export { RateLimitCounter } from "./rate-limit-do";
-
 // Credentialed CORS for the web origin (+ dev origins), scoped to /api/auth/*
 // only — this worker has no other public surface (D1: "CORS becomes trivial").
 const authCors = cors({