Overview
Design a distributed API Rate Limiter middleware deployed at scale across multiple regions, supporting custom client thresholds (e.g. 100 req/min per IP/API Key).
Requirements
- 1Accurately enforce request limits per user ID, API key, or client IP address
- 2Return HTTP 429 Too Many Requests with informative retry headers when threshold exceeded
- 3Low latency overhead (<2ms added to incoming requests)
- 4Distributed consistency across multiple gateway instances without race conditions
- 5Support tiered rate limits and configurable sliding window intervals
Architecture Hints (4)
Target Concepts
#Token Bucket#Redis Lua#API Gateway#Distributed Locks