Enforce per-key rate limits on API requests #15

New issue

Open

opened 2026-07-01 01:01:13 +00:00 by manlycucumber · 0 comments

manlycucumber commented

2026-07-01 01:01:13 +00:00

(Migrated from github.com)

Problem

Rate limits must be enforced cheaply and consistently. We need an enforcement layer that rejects bursts over the configured per-key rate.

Acceptance criteria

Requests exceeding a key's rate limit receive HTTP 429 with a Retry-After header
The limiter uses a fixed- or sliding-window counter that does not require a MySQL write per request
Limit state is isolated per key so one tenant cannot affect another
Under-limit requests pass through with negligible overhead

Notes

Prefer Cloudflare edge / in-memory counters over per-request MySQL writes.

## Problem Rate limits must be enforced cheaply and consistently. We need an enforcement layer that rejects bursts over the configured per-key rate. ## Acceptance criteria - [ ] Requests exceeding a key's rate limit receive HTTP 429 with a `Retry-After` header - [ ] The limiter uses a fixed- or sliding-window counter that does not require a MySQL write per request - [ ] Limit state is isolated per key so one tenant cannot affect another - [ ] Under-limit requests pass through with negligible overhead ## Notes Prefer Cloudflare edge / in-memory counters over per-request MySQL writes.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Directorium/Site#15

No description provided.

Rows
Columns