Api Design medium
Your API has free (100 req/min) and paid (10,000 req/min) tiers. How should you implement this?
- A Use a centralized rate limiting service with tier-specific quotas stored in a fast key-value store like Redis, keyed by the client's API token.
- B Deploy physically isolated clusters of API servers for each tier, using DNS-level routing to direct free and paid users to their respective hardware.
- C Embed the specific rate limit values directly into the application's source code to ensure that every request undergoes strictly local validation logic.
- D Enforce a uniform rate limit for all users across the system to maintain fairness and prevent any single client from monopolizing the shared thread pool.
Answer: A. Use a centralized rate limiting service with tier-specific quotas stored in a fast key-value store like Redis, keyed by the client's API token.
Storing rate limits per-user (or per-tier) in a high-performance store like Redis allows for dynamic and flexible enforcement. When a request arrives, the API checks the user's tier, retrieves their limit, and updates their usage counter. Hard-coding limits or deploying separate servers is inflexible and harder to manage at scale.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- You're designing a REST API for a blog. Which endpoint best represents 'get all comments for post 123'?
- A client wants to update only the 'status' field of an order, leaving other fields unchanged. Which HTTP method is most appropriate?
- A client calls POST /users with valid data, and the user is created. What status code should the server return?
- A client retries a failed 'POST /payments' request due to network timeout. The server receives the request twice. Without idempotency handling, what can happen?
- An API returns 10,000 products. Returning all in one response is impractical. Which pagination approach is simple and stateless?
- Your API serves both mobile apps and third-party integrations. Which authentication method is most appropriate?