Enforce per-key rate limits with standard headers #26

New issue

Closed

opened 2026-07-01 00:58:15 +00:00 by manlycucumber · 1 comment

manlycucumber commented

2026-07-01 00:58:15 +00:00

(Migrated from github.com)

Problem

Beyond long-period quotas, the service needs short-window rate limiting to protect the origin from cold-path bursts. Clients should see standard rate-limit headers.

Acceptance criteria

Per-key request rate is limited within a configurable short window.
Responses include standard rate-limit headers (limit, remaining, reset).
Exceeding the rate returns the canonical 429 error with a retry hint.
Rate-limit behavior is covered by tests including burst scenarios.

Notes

Rate limiting applies on cache misses reaching the origin, not on edge-cached hits.

## Problem Beyond long-period quotas, the service needs short-window rate limiting to protect the origin from cold-path bursts. Clients should see standard rate-limit headers. ## Acceptance criteria - [ ] Per-key request rate is limited within a configurable short window. - [ ] Responses include standard rate-limit headers (limit, remaining, reset). - [ ] Exceeding the rate returns the canonical 429 error with a retry hint. - [ ] Rate-limit behavior is covered by tests including burst scenarios. ## Notes Rate limiting applies on cache misses reaching the origin, not on edge-cached hits.

manlycucumber commented

2026-07-03 06:11:04 +00:00

(Migrated from github.com)

Delivered in #137 (squash-merged to develop).

Delivered in #137 (squash-merged to `develop`).

manlycucumber referenced this issue from a commit

2026-08-05 19:02:25 +00:00

feat: API keys, per-tenant quotas, and per-key rate limits (#137)

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Directorium/Api#26

No description provided.

Rows
Columns