Dynamic rate limiting - Portal

Add Consumer Metadata

Let's make our rate-limiting policy more dynamic, based on properties of the customer. Create a new consumer (Services -> API Key Service -> Configure -> Create Consumer), and in the Metadata field, set the following:

Code
{
  "customerType": "free"
}

Update the metadata of your other API Key consumer (3-dot menu -> Edit) from Step 3 to

Code
{
  "customerType": "premium"
}

Now that there are users with different customerType, this information can be used to rate limit them differently.

Add a Custom Code Module

Navigate back to the Code tab. Now add a new module to the files section by clicking the + next to the modules folder and choose new empty module. Name the module rate-limit.ts.

Add the following code to your module.

Code
import { ZuploContext, ZuploRequest } from "@zuplo/runtime";

export function rateLimit(request: ZuploRequest, context: ZuploContext) {
  const user = request.user;

  // premium customers get 1000 requests per minute
  if (user.data.customerType === "premium") {
    return {
      key: user.sub,
      requestsAllowed: 1000,
      timeWindowMinutes: 1,
    };
  }

  // free customers get 5 requests per minute
  if (user.data.customerType === "free") {
    return {
      key: user.sub,
      requestsAllowed: 5,
      timeWindowMinutes: 1,
    };
  }

  // everybody else gets 30 requests per minute
  return {
    key: user.sub,
    requestsAllowed: 30,
    timeWindowMinutes: 1,
  };
}

Update your Policy

Now we'll reconfigure the rate-limiting policy to wire up our custom function. Find the policy in the Route Designer and click Edit.

Update the configuration to

Code
{
  "export": "RateLimitInboundPolicy",
  "module": "$import(@zuplo/runtime)",
  "options": {
    "rateLimitBy": "function",
    "requestsAllowed": 2,
    "timeWindowMinutes": 1,
    "identifier": {
      "export": "rateLimit",
      "module": "$import(./modules/rate-limit)"
    }
  }
}

By changing the rateLimitBy to function you are indicating the rate limit will be determined by a module at runtime. The identifier property is used to indicate the module and function to run. Make sure to save once you've made your changes.

Test your Policy

Using the Test modal, you can try your dynamic rate limiting. You can grab the key for each consumer from Services → API Keys → Consumers where you created them. Like Step 3, you can fill in the keys into the Authorization header and start making calls until you hit your rate limit. Try out the other key and observe the difference in rate limits.