Performance

One client stuck in a retry loop with no backoff can put more load on your API in a minute than your other ten thousand clients combined. From your side it won’t look like an attack. It looks like a bug on their end, and it becomes an incident on yours. A rate limiter caps that client before it gets there. What does a rate limiter actually decide? On every request, the limiter asks one thing: has this key made too many requests in the current window? Three choices turn that into something you can implement. ...

On a million-row table, the same SELECT can take fifty milliseconds or well under one. The only difference is whether the database reads every row to find the ones you asked for, or jumps straight to them. An index is what lets it jump, and you pay for it on every write. Concretely, an index is a second, sorted copy of one or more columns, stored next to the table and updated automatically whenever the table changes. The database uses it to reach matching rows without touching the rest. ...