API Rate Limiter Designer

This skill works through your rate limiting problem from first principles: what the limit actually protects (database capacity, fairness across tenants, abuse prevention, or revenue tier enforcement), which algorithm fits that goal (token bucket, sliding window, or fixed window — and why the choice is not arbitrary), and how to key the limit correctly across IP, user identity, API key, and endpoint dimensions. It then produces a Redis implementation plan designed to avoid per-request latency overhead, a 429 response format with accurate Retry-After and X-RateLimit headers, an exemption path for high-trust clients, and a log-only rollout sequence so you calibrate thresholds against real traffic before enforcement goes live.

A typical buyer interaction: you describe your API shape ('Node.js REST API, three endpoints, one of which hits Postgres for every call; we have free-tier and paid-tier users; we've had one incident where a misconfigured client hammered /search at 400 req/s'), your traffic baseline, and what you need to stop. The skill asks four clarifying questions — stack, goal, constraints, audience — then produces the full design calibrated to those specifics.

Illustrative output excerpt — Algorithm Selection section: 'Use a token bucket per API key for /search. Fixed window would let a client fire 400 requests in the first second of each minute; sliding window adds correctness but costs an extra Redis ZADD per request. Token bucket with a Redis INCR + TTL pattern (Lua script for atomicity) gives burst tolerance and O(1) overhead. Recommended bucket: 60 tokens, refill 1/sec, burst ceiling 20. Separate limit for /export: fixed window daily quota is appropriate there because the cost is proportional to time, not request rate.'