I'm wrapping up development of my api on top of Cloudflare's workers and am about to start setting up rate-limitting. Initially wanted to do this via serverles redis, but it looks like WAF https://developers.cloudflare.com/waf/ achieves the same. But I cant manage to find this setting under my workers page. I believe it is only available for domains? Am I correct in assuming that in order to limit my workers routes, I can only do so when custom domain is set up for it?

Yes, that's correct. You don't get much control over the

workers.dev

domain and I'd strongly recommend against using it for production apps even though you can.