Sign in Get started

Rate Limiting, Quotas & Abuse Protection · Capstone

Capstone: Rate Limits for a Public API

Design the complete rate-limiting and quota scheme for a developer API.

Scenario

A geocoding SaaS exposes a public REST API and a GraphQL API to 8,000 developers on Free, Pro and Enterprise plans. Recent incidents: one customer's batch job slowed everyone down; a scraper used 300 free accounts; GraphQL queries vary 1000× in cost.

Requirements

  • Plan-based quotas and burst limits
  • Fairness across tenants
  • Cost-aware GraphQL limits
  • Clear communication to developers

Constraints

  • Limiter must add < 2 ms p99
  • Must survive Redis failover without a full outage

Deliverables

  1. Define the limits, keys and algorithms.
  2. How will you communicate limits and handle failures?
  3. How do you stop the multi-account free-tier scraper?

Draft each deliverable below before revealing the model answer and rubric.

Further reading: Stripe: Rate limiters

Deliverables

Define the limits, keys and algorithms.

Model answer

  • Algorithms: token bucket/GCRA in Redis (Lua) for per-key bursts; sliding window counter for per-tenant per-minute; monthly quota counters reconciled with the metering pipeline
  • Keys: per API key (burst), per tenant (aggregate), per IP for unauthenticated, GraphQL by calculated cost points
  • Plans: Free 10 req/s burst 20, 100k/month; Pro 100 req/s burst 200, 5M/month; Enterprise custom + dedicated cell
  • Batch endpoints: concurrency limit per tenant (5)

Rubric

Strong answers layer per-key, per-tenant and cost limits and handle batch jobs with concurrency limits.

How will you communicate limits and handle failures?

Model answer

429 + Retry-After + Problem Details; RateLimit-Policy/RateLimit headers; GraphQL extensions.cost; usage API + dashboard + 80/100% emails; SDKs honor Retry-After. Local in-process token buckets as a fallback when Redis is unavailable (fail open globally, fail closed for signup/login); alerts on fail-open mode.

Rubric

Look for explicit failure behavior and developer-facing signals.

How do you stop the multi-account free-tier scraper?

Model answer

Tenant identity across accounts (device/payment fingerprint, email domain, IP/ASN clustering), signup limits + verification (phone/card for higher free usage), bot scores at the edge, anomaly detection on query patterns, and terms enforcement; offer a paid bulk plan.

Rubric

Strong answers recognize that rate limits alone can't stop distributed multi-account abuse.

Open in the app to mark lessons complete, take notes and track your progress.