AI builder who teaches what he ships — new production AI lessons
    Jasmin.
    All Architectures
    Data InfrastructureIntermediate

    Rate Limiting & Session Store

    The gateway pattern every public API needs: Redis sliding-window (or token-bucket) limits per IP, user, and API key; session or refresh-token store; and Postgres for the durable key registry. Stops brute force and noisy neighbours without putting a load balancer in application code.

    10K – 1Musers supported
    $60 – $700/month infrastructure

    Architecture Diagram

    Interactive — hover over any node to see its role and description.

    ClientEdge / GWALB / KongLimiterSliding windowRedisLimits + sessionsApp APIPostgreSQLAPI keysWAFAWS WAFUserAPIBackendCacheDatabaseExternal

    Use Cases

    Public APIs with free vs paid quotas
    Login endpoints that must resist credential stuffing
    Multi-tenant SaaS fair-use limits
    WebSocket connection caps per account
    Partner API keys with burst and daily caps

    Technology Stack

    frontend

    Next.js

    backend

    Node.jsNginx / KongLua or middleware

    database

    RedisPostgreSQL

    infrastructure

    AWS ALBElastiCacheAPI Gateway optional

    Scalability Roadmap

    Stage 10 – 20K users· App middleware + Redis

    Express/Laravel throttle. One Redis. Good enough to launch.

    Stage 220K – 200K users· Gateway + replica

    Limits at Kong/Nginx. Redis replica. Separate DB index for sessions.

    Stage 3200K – 1M users· Redis Cluster

    Sharded counters. Per-tenant and per-key dimensions. Observability on 429s.

    Stage 41M+ users· Regional limiters

    Local Redis per region so limit checks stay <5ms. Global quota synced asynchronously.

    Cost Breakdown

    Development Cost

    $5,000 – $14,000 (3–7 weeks)

    Infrastructure Cost

    $60 – $700/month

    Maintenance Cost

    $500 – $1,500/month for quota product changes and abuse response

    Security Considerations

    API keys stored hashed; Redis only sees a key id
    Fail-closed on auth paths, fail-open on public reads if Redis dies (product choice)
    Admin bypass keys are short-lived and audited

    More Architectures

    Data Infrastructure

    pgvector Semantic Search

    Embeddings, HNSW indexes, and hybrid SQL + vector search in Postgres

    Data Infrastructure

    Redis Caching Platform

    Cache-aside, write-through, sessions, and hot-key protection

    Data Infrastructure

    Multi-Region Database

    Aurora Global, regional failover, and reads close to the user

    Need This Architecture Built?

    Get a detailed architecture plan, technology recommendations, development roadmap, and infrastructure estimation for your project.