Rate Limits

curl -v "http://localhost:8080/users" \
  -H "Authorization: Bearer YOUR_TOKEN"

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
X-Request-ID: a1b2c3d4e5f6
X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 999
X-RateLimit-Reset: 1735689600

server:
  rate_limit:
    enabled: true
    requests_per_second: 100
    burst_size: 200
    per_tenant: true

curl -X GET "http://localhost:8080/users" \
  -H "Authorization: Bearer YOUR_TOKEN"

HTTP/1.1 429 Too Many Requests
Content-Type: application/json; charset=utf-8
X-Request-ID: f8a9b0c1d2e3
X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1735689660
Retry-After: 60

Initial state: 200 tokens (burst_size = 200)
Refill rate: 100 tokens/second

Request 1: 200 tokens remaining → allowed
Request 2: 199 tokens remaining → allowed
...
Request 201: 0 tokens remaining → rate limited

Wait 1 second: 100 tokens added
Request 202: 99 tokens remaining → allowed

server:
  rate_limit:
    enabled: true
    backend: redis
    requests_per_second: 100
    burst_size: 200
    redis:
      url: redis://localhost:6379
      key_prefix: "ratelimit:"
      ttl: 60s

async function fetchWithRetry(
  url: string,
  options: RequestInit,
  maxRetries = 3
) {
  let retries = 0;
  let delay = 1000; // Start with 1 second

  while (retries < maxRetries) {
    try {
      const response = await fetch(url, options);

      if (response.status === 429) {
        // Rate limited
        const retryAfter = response.headers.get('Retry-After');
        const waitTime = retryAfter 
          ? parseInt(retryAfter) * 1000 
          : delay;

        console.log(`Rate limited. Waiting ${waitTime}ms...`);
        await sleep(waitTime);

        retries++;
        delay *= 2; // Exponential backoff
        continue;
      }

      return response;
    } catch (error) {
      if (retries === maxRetries - 1) throw error;
      
      await sleep(delay);
      retries++;
      delay *= 2;
    }
  }

  throw new Error('Max retries exceeded');
}

function sleep(ms: number) {
  return new Promise(resolve => setTimeout(resolve, ms));
}

import time
from typing import Optional

class RateLimitedClient:
    def __init__(self, base_url: str, token: str):
        self.base_url = base_url
        self.token = token
        self.remaining = None
        self.reset_time = None
    
    def _update_limits(self, response):
        """Update rate limit state from response headers"""
        self.remaining = int(response.headers.get('X-RateLimit-Remaining', 0))
        self.reset_time = int(response.headers.get('X-RateLimit-Reset', 0))
    
    def _should_wait(self) -> Optional[float]:
        """Check if we should wait before making request"""
        if self.remaining is not None and self.remaining < 10:
            # Less than 10 requests remaining, wait until reset
            if self.reset_time:
                wait_time = self.reset_time - time.time()
                if wait_time > 0:
                    return wait_time
        return None
    
    def request(self, method: str, path: str, **kwargs):
        # Check if we should wait
        wait_time = self._should_wait()
        if wait_time:
            print(f"Rate limit low, waiting {wait_time:.1f}s...")
            time.sleep(wait_time)
        
        # Make request
        response = requests.request(
            method,
            f"{self.base_url}{path}",
            headers={'Authorization': f'Bearer {self.token}'},
            **kwargs
        )
        
        # Update limits
        self._update_limits(response)
        
        return response

# Total rate limited requests
http_rate_limited_total{tenant="abc"} 42

# Rate limit remaining by tenant
http_rate_limit_remaining{tenant="abc"} 958

# Rate limit utilization (0-1)
http_rate_limit_utilization{tenant="abc"} 0.042

server:
  rate_limit:
    enabled: false  # Disable for local development