Rate Limiting

1. The Incident

The store's public API serves mobile apps and a few hundred partner integrations. One Tuesday, a partner ships a bug. Their integration retries in a loop with no backoff. Backoff means waiting longer between each retry. Their traffic goes from 40 requests per second to 4,000.

Their credentials are valid. Every request is authenticated, well formed, and looks legitimate. The gateway checks each one in politely, one hundred times over budget. The services are overwhelmed, for everyone