Rate Limiting

1. The Incident

The store's public API serves mobile apps and a few hundred partner integrations. One Tuesday, a partner ships a bug: their integration retry-loops without backoff, and their traffic goes from 40 requests per second to 4,000. Nothing about their credentials is invalid; every request is authenticated, well-formed, and legitimate-looking. The gateway checks them in politely, one hundred times over budget, and the services drown: for everyone. Every other partner and every mobile user shares the outage one customer's bug created.