Yash
    01 / 05·Live·All case studies

    LimitYourAPI

    API rate limiting SaaS, built end to end.

    Live siteDocsGitHub
    LimitYourAPI — project preview

    Overview

    LimitYourAPI is an API rate limiting and usage metering SaaS. Developers add it to their API with an SDK or a REST call, then manage keys, limits, usage and billing in a dashboard.

    I built it end to end: the Go API and Redis Lua limiters, the React dashboard, SDKs for Node.js, Go and Python, a Cloudflare Workers edge limiter, Stripe billing, and the CI/CD pipeline and AWS infrastructure.

    Problem

    Most API rate limiting implementations either become inconsistent under concurrency or depend heavily on infrastructure-specific edge products.

    A lot of existing tooling lacks application-level context, flexible quota control, or developer-friendly integration flows.

    The goal was a product with predictable behavior under load, low operational overhead, and a clean SDK and dashboard experience.

    Architecture

    The API is written in Go (Gin). Each limiting strategy (token bucket, sliding window, quota and AI spend) is one Lua script that Redis runs atomically, so concurrent requests cannot overshoot a limit.

    PostgreSQL stores accounts, API keys and usage history. Request logs are batched and flushed in the background, and a Prometheus-format metrics endpoint reports the service's health.

    The dashboard is React with Vite, React Router and Chart.js. Auth uses JWTs with TOTP two-factor, and billing runs on Stripe webhooks.

    SDKs for Node.js (published on npm), Go and Python wrap the API with fail-open behavior and retries, and a Cloudflare Workers limiter runs checks at the edge.

    GitHub Actions runs the Go tests, the frontend build, Terraform checks and SDK validation on every change, and a manual, environment-gated deploy workflow builds Docker images and rolls them out to AWS ECS Fargate, signing in to AWS with OIDC instead of stored keys. RDS, ElastiCache and autoscaling are defined in Terraform.

    Request path

    1. Your APINode.js, Go or Python SDK, or a REST call
    2. Go APIStateless; scales out
    3. RedisOne Lua script per strategy, run atomically

    Usage, off the hot path

    1. Request logsBatched in memory
    2. PostgreSQLUsage and quota history
    3. DashboardReact and Chart.js

    Delivery

    1. GitHub ActionsGo tests, frontend build, Terraform checks
    2. Docker imageGated deploy; AWS access via OIDC
    3. AWS ECS FargateRDS, ElastiCache and autoscaling in Terraform
    Every allow or deny is one Redis round trip; usage is logged in batches, off the request path.

    Tradeoffs

    The system prioritizes deterministic application-layer quota enforcement over broad infrastructure firewall capabilities.

    Certain edge-network protections and globally distributed caching strategies were intentionally not built to keep operational complexity manageable.

    Stateless API instances made scaling simple but put all coordination on Redis, which is why every limit is a single atomic script.

    6–14 µs
    Redis CPU per check
    70,000+ / s
    Checks per Redis core
    Node.js, Go, Python
    SDKs

    What I'd do differently

    Shipping a whole product alone taught me as much about the parts around the core as the core itself: the dashboard, SDK ergonomics, billing edge cases, and a deploy pipeline I can trust.

    It also reinforced how much developer trust depends on documentation quality and stable behavior under failure conditions.

    Writing about LimitYourAPI