A rate limit in nginx that should have been in the application

A limit keyed on the client address at the edge, protecting an endpoint whose consumers are authenticated and identifiable.

limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;

location /api/ {
    limit_req zone=api burst=20 nodelay;
}

# which means four integrators behind one corporate
# gateway share ten requests a second, and a single
# consumer on a residential connection gets ten to
# themselves.

The edge knows the address and the application knows the credential, and only one of those is the right unit. The edge limit stays as a blunt instrument against unauthenticated floods — that is genuinely what it is for — and the per-consumer limit moved into the application where the API key is available.