Systems and methods for API rate limiting and distribution

• US 10,057,378 B2
• Filed: 02/10/2015
• Issued: 08/21/2018
• Est. Priority Date: 02/10/2014
• Status: Active Grant

• Current Assignee: BigCommerce Pty. Ltd. (BigCommerce Holdings, Inc.)
• Original Assignee: BigCommerce Pty. Ltd. (BigCommerce Holdings, Inc.)
• Inventors: Kosim-Satyaputra, Qamal, Christopher, Scott Lachlan
• Primary Examiner(s): Nguyen, Dustin
• Assistant Examiner(s): Guzman, Javier O
• Application Number:
  US14/618,719
• Publication Number:
  US 20150229579A1
• Time in Patent Office: 1,288 Days
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/1031 Controlling of the operation of servers by a load balancer, e.g. adding or removing servers that serve requests
• CPC Class Codes: H04L 67/2876 Pairs of inter-processing entities at each side of the network, e.g. split proxies
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching

Abstract

An API rate limiting system may receive a client request from an API client associated with a tenant, formulate a proxied request with an internal authentication specific to the tenant, and send the proxied request to API endpoints (tenant resources) at a store. The store fulfills the request, accessing and modifying local database(s) as needed, and returns a response to the system. The system returns the response to the API client along with information about the API client'"'"'s quota for the current time window. The system may calculate the quota based on a resource limit with respect to a number of clients accessing a resource. In some embodiments, the system may implement an exponential distribution function in making a determination on a quota per API client per time window.

Claims

1. A method, comprising:

receiving, by an application programming interface (API) proxy system embodied on a cluster of server machines, a client request from an API client;

the API proxy system calculating a quota of requests allowed for the API client for a current time window based at least in part on a number of active API clients during the current time window and a tunable scaling factor, wherein the quota of requests allowed for the API client for the current time window is calculated using an exponential distribution function, wherein the exponential distribution function is formulated as;

2. The method according to claim 1, wherein C is 3600.

3. The method according to claim 1, further comprising:

adjusting the tunable scaling factor to account for burst behavior of the API client;

or

adjusting the value of the current time window and the tunable scaling factor.

4. The method according to claim 1, further comprising:

tracking a number of client requests from the API client for the current time window; and

comparing the number of client requests from the API client for the current time window with the quota of requests allowed for the API client for the current time window.

5. The method according to claim 1, further comprising:

tracking the number of active API clients, wherein tracking the number of active API clients comprises;

determining whether the API client is already connected; and

if the API client is not already connected;

marking the API client as connected; and

incrementing a counter tracking the number of active API clients.

6. An application programming interface (API) proxy system, comprising:

at least one processor;

non-transitory computer memory;

instructions embodied on the non-transitory computer memory and translatable by the at least one processor to perform;

receiving a client request from an API client;

calculating a quota of requests allowed for the API client for a current time window based at least in part on a number of active API clients during the current time window and a tunable scaling factor, wherein the quota of requests allowed for the API client for the current time window is calculated using an exponential distribution function, wherein the exponential distribution function is formulated as;

7. The proxy system of claim 6, wherein C is 3600.

8. The proxy system of claim 6, wherein the instructions are further translatable by the at least one processor to perform:

adjusting the tunable scaling factor to account for burst behavior of the API client;

or

adjusting the value of the current time window and the tunable scaling factor.

9. The proxy system of claim 6, wherein the instructions are further translatable by the at least one processor to perform:

tracking a number of client requests from the API client for the current time window; and

comparing the number of client requests from the API client for the current time window with the quota of requests allowed for the API client for the current time window.

10. The proxy system of claim 6, wherein the instructions are further translatable by the at least one processor to perform:

tracking the number of active API clients, wherein tracking the number of active API clients comprises;

determining whether the API client is already connected; and

if the API client is not already connected;

marking the API client as connected; and

incrementing a counter tracking the number of active API clients.

11. A computer program product comprising at least one non-transitory computer readable medium storing instructions translatable by at least one processor to perform:

receiving a client request from an API client;

calculating a quota of requests allowed for the API client for a current time window based at least in part on a number of active API clients during the current time window and a tunable scaling factor, wherein the quota of requests allowed for the API client for the current time window is calculated using an exponential distribution function, wherein the exponential distribution function is formulated as;

12. The computer program product of claim 11, wherein

C is 3600.

13. The computer program product of claim 11, wherein the instructions are further translatable by the at least one processor to perform:

adjusting the tunable scaling factor to account for burst behavior of the API client;

or

adjusting the value of the current time window and the tunable scaling factor.

14. The computer program product of claim 11, wherein the instructions are further translatable by the at least one processor to perform:

tracking a number of client requests from the API client for the current time window; and

comparing the number of client requests from the API client for the current time window with the quota of requests allowed for the API client for the current time window.

15. The computer program product of claim 11, wherein the instructions are further translatable by the at least one processor to perform:

tracking the number of active API clients, wherein tracking the number of active API clients comprises;

determining whether the API client is already connected; and

if the API client is not already connected;

marking the API client as connected; and

incrementing a counter tracking the number of active API clients.