distributed rate limiter service

API gateway enforcing per-client rate limits across multiple app instances with shared Redis state.

python, fastapi, redis, postgresql, docker, pytest

Two Dockerized FastAPI instances share a single Redis container as the source of truth, so limits are enforced correctly across processes instead of each instance keeping its own count. Token-bucket and sliding-window algorithms sit behind one shared interface and stay atomic via Lua scripts run through EVAL, avoiding the race conditions a naive read-then-write counter hits under concurrent requests.

API keys are generated with Python's secrets module and stored as SHA-256 hashes for fast, indexable lookup rather than slow password-style hashing. Blocking SQLAlchemy and Redis calls inside the async middleware are offloaded to a thread pool with run_in_threadpool, so one client's I/O never freezes the event loop for everyone else. A boundary-comparison test suite verified both algorithms correctly cap clients under a burst-at-window-reset scenario, and a documented run confirms one client's requests, alternated across both instances, are rate limited as a single combined total.