rate-limiter

API rate limiting blocks excessive requests to protect services. You can enforce tiered limits on authentication, API, and public endpoints using Redis-backed storage, with an in-memory fallback for graceful degradation if Redis is unavailable.

Yes, API rate limiting supports tiered limits by endpoint sensitivity. You can define per-endpoint rules to apply stricter throttling to authentication endpoints while allowing higher limits for public endpoints.

Yes, the rate limiter features graceful degradation if Redis is down. It automatically falls back to in-memory storage to maintain API throttling, ensuring backend resources remain protected even without Redis.

API rate limiting includes IP whitelisting for trusted IPs and service accounts. You can configure these exemptions to bypass throttling rules, ensuring legitimate internal or partner traffic is never blocked.

When clients exceed API rate limits, the system defines proper Retry-After headers. This informs clients exactly how long to wait before retrying requests, improving client integration and reducing repeated abuse attempts.

In-memory fallback ensures continuous API throttling when Redis is unavailable. It prevents complete service exposure during storage outages by maintaining rate limit enforcement locally, avoiding sudden backend resource overload.