One client is already over its limit. It's still melting your Redis.

transcript

This client is already blocked. Every request gets a 429. And it's still hurting every other user on your API.

It sends 50,000 requests a second. Way over its limit. Every request still asks Redis: is this client over? All to one shard. That's a hot key. Every other client on that shard slows down.

Here's the trap. Saying no still costs a Redis call. So stop asking. The answer won't change until the reset.

The first deny comes back. The gateway remembers: denied until reset. Every request after that gets its 429 straight from memory. Redis hears from each gateway about once per reset period. Better still, a coarse per-IP limit at the edge drops floods first.

Before: 50,000 checks a second on one shard. After: about one call per gateway, per reset period. And an internal service allowed 50,000 a second? Count locally. Sync to Redis every 100 milliseconds.

A denied client shouldn't cost you anything. Not even a lookup. Cache the no. Let the flood hit memory, not Redis.

Full breakdown in the lecture.