The subtle art of API Rate Limiting

Based on our blog post of the same title (https://zuplo.com/blog/2023/05/02/sub...) this is Zuplo's hot take on what really matters when it comes to protecting your API with rate-limiting. You'll find no discussion of algorithms like token bucket vs sliding window here - instead, we get into the real nitty-gritty of what is really important for your API's protection and customer experience. What did we miss?

=== Chapters ===

00:00 Intro
00:30 Background
02:24 The three pillars of an API program
03:44 1/ Canonical Rate-Limiting Implementation
06:20 2/ Public or private quotas / thresholds
08:33 3/ How should rate limits be applied?
14:30 4/ Rate limiting and distributed systems
19:40 5/ Rate limiting latency
20:50 6/ Latency/Accuracy tradeoff
23:47 7/ Observability
25:50 8/ How do I know what rate limits to set?
27:45 Conclusion

=== Links ===

Open Source Rate Limiter examples:
* https://flask-limiter.readthedocs.io/...
* https://www.npmjs.com/package/express...
* https://github.com/mailgun/gubernator

API Keys Best Practices
* Video:    • API Key Authentication Best Practices  
* Article: https://zuplo.com/blog/2022/12/01/api...

Other useful resources for API developers
* https://zuplo.com/blog/2023/04/24/use...