An API with no limits

Here's a small API: one server, api-1, with two worker slots. It can finish about 2.5 requests per second. Alice and Bob use it gently, and every answer comes back green.

Then a scraper shows up and starts pulling every product page it can find, five requests a second. The server can't keep up. Its waiting room fills, and it starts answering 503 Service Unavailable: to the scraper, and to Alice and Bob too.

One client just ruined the API for everyone. Scrapers, bots guessing passwords on your login page, and buggy clients stuck in a retry loop all look like this. Even when nothing breaks, every request costs CPU, database time and money.