Rate limiter

medium 60 min Python Shopify-styleStripe Bug Squash-style

1 Three keys, three times the limit
2 Build a feature
3 Make it fast

repo

gateway/
tests/
visible/

read-only

# gateway

The front door of a payments API. Every request carries an API key; each
merchant can have several keys (one per warehouse, one per environment...).
Rate limits are **per merchant**: all of a merchant's keys share one budget.

    gateway/models.py      Request and Response
    gateway/keys.py        KeyStore: which merchant owns an API key
    gateway/config.py      LimitConfig: each merchant's limit and window
    gateway/limiter.py     SlidingWindowLimiter: "at most N requests in any W seconds"
    gateway/middleware.py  handle(): auth, rate limiting, then the app

Times are seconds (floats) since some fixed start. A request at time `t`
counts against the window `(t - window_s, t]`.

Run the tests with `python -m pytest` (or press Run in the browser).

Phase 1 of 3 0:00

Three keys, three times the limit

Incident #902 · severity: 2 · from: platform on-call

Merchant m_acme has the standard limit (100 requests per minute), but last night the dashboard showed them at ~300 requests a minute for an hour and they never got a single 429. Their database fell over, not ours, but we promised them the limiter protects them. They use three API keys, one per warehouse.

Limits are per merchant: all of a merchant's keys share one budget (see the README).

tests/visible/test_merchant_limit.py reproduces it. Make it pass.
On Submit, hidden tests check that merchants don't share budgets with each other, that one key alone still gets the full limit, and that the window slides.

Bring your own AI: paste the copied repo into Claude, ChatGPT or Gemini. In a real interview the assistant usually reads the files itself. Or download the zip, work in your own editor, and upload the files you changed.