Rate limits

API Gateway rate limiting caps the request volume a single caller can send to an endpoint within a specified time window. Throttling prevents traffic surges and manages backend compute costs.

Configuring rate limits

Rate limits are configured using the format <requests>/<unit> (for example, 100/minute).

Property	Values	Description
requests	Positive integer	Maximum allowed requests per time window.
unit	second, minute, hour, day	Time window duration.
key	client_ip or api_key	Counter bucket key. Defaults to client_ip.

---

1. Apply a rate limit

platformctl

platformctl gateway endpoint update support-api --rate-limit 100/minute --rate-limit-by client_ip

To remove a rate limit:

platformctl gateway endpoint update support-api --clear-rate-limit

curl

curl -sS -X PATCH "$CAI_API/v1/projects/$CAI_PROJECT/gateway/endpoints/support-api" \
  -H "Authorization: Bearer $CAI_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"rate_limit": {"requests": 100, "unit": "minute", "key": "client_ip"}}'

To clear a rate limit, pass null:

curl -sS -X PATCH "$CAI_API/v1/projects/$CAI_PROJECT/gateway/endpoints/support-api" \
  -H "Authorization: Bearer $CAI_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"rate_limit": null}'

Console UI

1. Navigate to your endpoint's Access tab in the Crusoe Console.
2. Click Set Rate Limit.
3. Choose the request limit, time window, and counting key (client_ip or api_key).
4. Click Save.

---

2. Counter keys (client_ip vs api_key)

• client_ip: Tracks request counts by the caller's origin IP address. Works across all authentication modes.
• api_key: Tracks request counts per API key. Requires apikey authentication mode.

---

3. Rate limit HTTP headers

When a rate limit is active, the Gateway includes rate limit status headers in every response:

Response Header	Description
X-RateLimit-Limit	Maximum request capacity for the configured window.
X-RateLimit-Remaining	Remaining request capacity in the current window.
X-RateLimit-Reset	Time remaining (in seconds) until the window resets.

If a caller exceeds the ceiling, the Gateway returns HTTP 429 Too Many Requests.

---

High availability behavior

API Gateway distributes rate limit counters across edge nodes. High-availability distributed counters guarantee consistent enforcement across edge regions without imposing latency penalties.