Engineering notes
Distributed Rate Limiter
Atomic Redis Lua enforcement across tiers — anonymous k6 runs hit 99.47% 429s with 12.37ms p95 latency; pro-tier allowance tracks theoretical refill.
The challenge
Naive in-process rate limiters break across multiple servers. Real SaaS products need shared Redis state, atomic enforcement under concurrency, and different limits per customer tier — without duplicating the enforcement logic.
Important decisions
Three algorithms, one Redis Lua core
Sliding Window Counter (anonymous), Sliding Window Log (free), and Token Bucket (pro) share the same middleware path — tiers swap algorithms, not code paths.
Tiered per-API-key limits
X-Api-Key resolves anonymous/free/pro with deliberately different algorithms and budgets so burst vs exactness tradeoffs are visible in the dashboard and k6 runs.
Observability as first-class
Prometheus histograms/counters, /health + /ready probes, structured pino JSON logs, and OpenAPI at /docs — not bolted on after the demo.
Measured results
99.47% 429s
Anon enforcement
~349 / 300+refill
Pro allowed ≈ theory
12.37ms
Anon p95 latency