API Keys, TYPICALLY, THIRD-PARTY INTEGRATIONS/SERVICE-TO-SERVICE COMMUNICATION ke liye, USE HOTE hain (JWT ki TARAH, INDIVIDUAL USERS ke liye NAHI) — EK UNIQUE, LONG, RANDOM STRING, HAR CLIENT APPLICATION ko, ISSUE ki jaati hai, aur, HAR REQUEST mein, HEADER (jaise X-API-Key) mein, PASS ki jaati hai.

Rate Limiting, EK CLIENT ko, EK TIME WINDOW mein (jaise, 100 REQUESTS PER MINUTE), KITNI REQUESTS, KARNE DI JAAYE, YE CONTROL karta hai — SERVER ko, ABUSE/OVERLOAD SE, BACHATA hai. Bucket4j jaisi LIBRARIES, ISE, EASILY, IMPLEMENT karne DETI hain, TOKEN BUCKET ALGORITHM SE.

// API Key validation, filter mein:
@Component
public class ApiKeyFilter extends OncePerRequestFilter {
    protected void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain chain)
            throws ServletException, IOException {
        String apiKey = req.getHeader("X-API-Key");
        if (apiKey == null || !apiKeyService.isValid(apiKey)) {
            res.setStatus(HttpStatus.UNAUTHORIZED.value());
            return;
        }
        chain.doFilter(req, res);
    }
}

// Rate limiting response header, COMMON convention:
// X-RateLimit-Limit: 100
// X-RateLimit-Remaining: 42
// X-RateLimit-Reset: 1699999999
// 429 Too Many Requests — LIMIT exceed hone par