Token Buckets, API Keys, and the Bug That Rate-Limited the Server
TL;DR
The /api/v1/books/fetchbookmetadata endpoint had no abuse protection. Any client could spam ISBN lookups indefinitely, exhausting Google Books anonymous quota for every user.
Implemented a han
buildingbibby.hashnode.dev11 min read