apilab

Overview ¶

Package apilab is APILab, a public developer API: API keys, per-key rate limits answered with 429 and Retry-After, cursor pagination, idempotent creates and webhook deliveries. It is the reference app for the public-apis pack.

Planted bottlenecks (see README.md), each switched off by a fix flag:

• keys: an API key is found by hashing it and scanning every stored key hash, so each request costs more the more keys exist (fix "keys" uses a map).
• limiter: rate limits are a sliding-window log behind one global lock that records refused attempts too, so a client that keeps hammering grows its own log and every other key waits on the lock (fix "limiter" uses sharded token buckets).
• webhooks: one worker delivers every webhook, so deliveries queue behind each other when events arrive in bursts (fix "webhooks" runs 32 workers).