Global limit vs per-key limit
A global limit counts all requests together, so a botnet and real people share one budget. A per-key limit gives each account its own budget. With 3,000 guesses/s at 10 accounts, a global limit of 1,000 requests/s lets 525 guesses/s through. The target is 20. A limit of 1 try/s per account passes.
Limit 1/s per account · all codes tried in 12 days
Buffer 1,000 jobs · last job waits 1.0 s · 17% turned away
Case 1
People send 200 codes/s across 100,000 accounts. A botnet sends 3,000 guesses/s at 10 accounts. At most 20 guesses/s may pass, and under 0.5 percent of real codes may fail.
| Measure | Goal | Global limit, 1,000 requests/s | Limit of 1 try/s per account |
|---|---|---|---|
| Throughput (Guesses) | under 20 req/s | 525 req/s Fail | 4 req/s Pass |
| Error rate (Codes) | under 0.5% | 0% Pass | 0% Pass |
| p99 latency (Codes) | under 150 ms | 115 ms Pass | 73 ms Pass |
| Monthly cost | 16 USD/mo | 16 USD/mo |