Problem Statement
Your public API sees bot spikes rotating API keys. How do you defend while minimizing false positives?
Explanation
Combine identity signals: key, IP/subnet, user agent fingerprints, and behavior features. Apply velocity rules across these dimensions, not just per key. Use progressive challenges (e.g., CAPTCHA or proof-of-work) before hard blocks and add reputation scores that decay over time.
Keep allow-lists for partners and offer higher-tier customers dedicated capacity. Always log decisions with reasons for later appeal and model tuning.
Code Solution
SolutionRead Only
score = f(keyRate, ipRate, uaEntropy); if(score>τ) challengeOrBlock();
