Model a token-bucket rate limit against a distributed attacker and check whether it still protects the backend.
A token bucket permits a burst up to the bucket size and then settles to the refill rate, so the requests one key can make in a window is the capacity plus the refill over that window. The protective question is what happens when the attacker holds many keys: throughput multiplies by the key count while your backend capacity does not move. Per-IP limits are the default and the easiest to defeat — a few hundred residential proxies turn a 10 req/s limit into thousands, so the limit has to be sized against the backend rather than against one client.
API Rate Limiting Security
A token bucket allows burst + refill rate × window requests per key over a window; a distributed attacker holding k keys sustains k × refill rate requests per second.
Protection check
backend saturation = attacker throughput ÷ backend capacity × 100; headroom = refill rate ÷ legitimate peak rate.
A token bucket allows burst + refill rate × window requests per key over a window; a distributed attacker holding k keys sustains k × refill rate requests per second. A token bucket permits a burst up to the bucket size and then settles to the refill rate, so the requests one key can make in a window is the capacity plus the refill over that window. The protective question is what happens when the attacker holds many keys: throughput multiplies by the key count while your backend capacity does not move.
Per-IP limits are the default and the easiest to defeat — a few hundred residential proxies turn a 10 req/s limit into thousands, so the limit has to be sized against the backend rather than against one client.
This calculator takes 8 inputs: Sustained limit, i.e. token refill rate, Bucket capacity, What the limit is keyed on, Keys or addresses the attacker controls, Attack window, Legitimate peak rate for one key, Backend capacity, Response to a breach. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Per account or per API key wherever a caller is authenticated, because that is the identity the attacker cannot mint for free. Keep an IP limit as a coarse outer layer for unauthenticated endpoints, and add a global concurrency cap so the backend is protected even when the per-key maths is defeated.