How do you guys handle rate limiting? It occurs to me that someone could build a bot which just sits there and hits my

graph.cool

endpoint with a bunch of requests. Two concerns, the first is billing, that’d probably lead to some severe bill shock, and secondly, what protections are in place to stop someone registering a flood of users, etc?

Good question. This also came to my mind. Since they are using AWS Serverless, I would hope that the API gateway is set up right. The gateway does have DOS protection but a flood of creates would be an issue

@nilan, sorry to poke you directly, just wondering if there are any docs or similar that I can look at to answer this question.

Hey @kevinbrown and @lancej, thanks for your concerns! We do have a request limit that's per project. We'll offer customizable settings and a better transparency into who made what requests soon.

Thanks @nilan, very helpful! So that I’m aware, what are the default settings at this stage? We’re still in development, just doing our due diligence and want to make sure I know how it works before we depend on graph.cool in production.

It's some dozen per second, I can't recall the specific limit at the moment.