LimitYourAPI API rate limiting SaaS, built end to end.

LimitYourAPI is an API rate limiting and usage metering SaaS. Developers add it to their API with an SDK or a REST call, then manage keys, limits and usage in a dashboard.

I built it end to end: the Go API and Redis Lua limiters, the React dashboard, SDKs for Node.js, Go and Python, a Cloudflare Workers edge limiter, the CI pipeline, and a Terraform setup for AWS that is not deployed yet (the API runs on Render).

Most API rate limiting implementations either become inconsistent under concurrency or depend heavily on infrastructure-specific edge products.

A lot of existing tooling lacks application-level context, flexible quota control, or developer-friendly integration flows.

The goal was a product with predictable behavior under load, low operational overhead, and a clean SDK and dashboard experience.

The main engineering constraint was keeping every limit exact under concurrent load without adding a coordination layer.

Usage logging could not slow the request path, so request logs are batched in memory and written to PostgreSQL in the background.

As a one-person product, it also had to be cheap to run and safe to change often, which is why every push runs the full CI.

The API is written in Go (Gin). Each limiting strategy (token bucket, sliding window, quota and AI spend) is one Lua script that Redis runs atomically, so concurrent requests cannot overshoot a limit.

PostgreSQL stores accounts, API keys and usage history. Request logs are batched and flushed in the background, and a Prometheus-format metrics endpoint reports the service's health.

The dashboard is React with Vite, React Router and Chart.js. Auth uses JWTs with TOTP two-factor. Stripe and Razorpay billing code exists, but paid plan upgrades are not wired up yet.

SDKs for Node.js (published on npm), Go and Python wrap the API and fail open by default; the Node.js and Python SDKs also retry. A Cloudflare Workers limiter runs checks at the edge.

GitHub Actions runs on every pull request and every push to main: the Go build, vet and tests with the race detector, the frontend build, a syntax check of the edge workers, Terraform validation and an SDK package check. The API runs on Render as a Docker image and the dashboard on Vercel. The repository also holds a Terraform setup for AWS (ECS Fargate, RDS, ElastiCache and autoscaling) and a manual deploy workflow for it that signs in to AWS with OIDC instead of stored keys. Neither has been run yet.

The system puts exact, application-level quotas ahead of network-level protection.

Stateless API instances made scaling simple but put all coordination on Redis, which is why every limit is a single atomic script.

When Redis cannot answer, each rule either fails open or fails closed. Failing open is the default, because refusing every request while the limiter is down is usually worse than letting traffic through for a while.

Shipping a whole product alone taught me as much about the parts around the core as the core itself: the dashboard, SDK ergonomics, billing edge cases, and a deploy pipeline I can trust.

It also reinforced how much developer trust depends on documentation quality and stable behavior under failure conditions.