---
title: "Discussion on \"Token Buckets, API Keys, and the Bug That Rate-Limited the Server\" | Hashnode"
description: "Discussion on \"Token Buckets, API Keys, and the Bug That Rate-Limited the Server\". TL;DR\n\nThe /api/v1/books/fetchbookmetadata endpoint had no abuse protection. Any client could spam ISBN lookups indefinitely, exhausting Google Books anonymous quota for every user.\n\nImplemented a han"
url: "https://hashnode.com/posts/token-buckets-api-keys-and-the-bug-that-rate-limited-the-server/69aa5b11b8d41e6dedfa13da"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Token Buckets, API Keys, and the Bug That Rate-Limited the Server](https://buildingbibby.hashnode.dev/token-buckets-api-keys-and-the-bug-that-rate-limited-the-server?utm_source=hashnode&utm_medium=feed)

TL;DR The /api/v1/books/fetchbookmetadata endpoint had no abuse protection. Any client could spam ISBN lookups indefinitely, exhausting Google Books anonymous quota for every user. Implemented a han

Mar 6 · 11 min read · buildingbibby.hashnode.dev  
Read the article

## Written by

[Leo D. Penrose](https://hashnode.com/@ldpenrose)

@ldpenrose

  
[View profile](https://hashnode.com/@ldpenrose)

## Responses

Markdown supported · ⌘↵ to post

No responses yet.