Rate limiting vs throttling for a public partner API
Our public API serves 40 partners. Some run batch jobs at midnight that burst to 50× normal; meanwhile scrapers and credential-stuffing bots hit login and search. Option A: rate limiting: a token bucket per API key; beyond the limit, return 429 with Retry-After. Option B:…