API rate limiter service

A small service that other apps call to check whether a key is over its limit, using Redis.

Why build it

Rate limiting is a core backend skill and the algorithms (fixed window, sliding window, token bucket) have real trade-offs you can measure.

Features

• Check endpoint with a key and rule
• Token bucket and sliding window algorithms
• Per-key configuration
• Response headers with remaining quota
• Metrics endpoint

Roadmap

1. p1

   Algorithms in memory

   • Implement fixed window, sliding window and token bucket as pure classes
   • Test each with a fake clock
2. p2

   Redis

   • Move state to Redis with Lua scripts for atomicity
   • Verify correctness under concurrent requests
3. p3

   Service

   • HTTP API with auth for callers
   • Config per key
   • Standard RateLimit headers
4. p4

   Prove it

   • Benchmark with autocannon
   • Write up the trade-offs between algorithms
   • Containerise with Docker Compose

Common pitfalls

• Read-then-write in Redis without a script, which races under load
• Using the server clock on multiple nodes without a shared time source

Skills you will practise

• Redis
• Concurrency
• Benchmarking
• Docker