You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: api-management/request-quotas.mdx
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ sidebarTitle: "Request Quotas"
7
7
8
8
## Introduction
9
9
10
-
Request Quotas in Tyk Gateway allow you to set a maximum number of API requests for a specific API key or Policy over longer, defined periods (e.g., day, week, month). This feature is distinct from rate limiting (which controls requests per second), and it is essential for managing API consumption, enforcing service tiers, and protecting your backend services from sustained overuse over time.
10
+
Request Quotas in Tyk Gateway allow you to set a maximum number of API requests for a specific API key or [Security Policy](/api-management/policies) over longer, defined periods (e.g., day, week, month). This feature is distinct from [rate limiting](/api-management/rate-limit) (which controls requests per second), and it is essential for managing API consumption, enforcing service tiers, and protecting your backend services from sustained overuse over time.
11
11
12
12
```mermaid
13
13
flowchart LR
@@ -33,7 +33,7 @@ flowchart LR
33
33
34
34
### Overview
35
35
36
-
In this tutorial, we will configure Request Quotas on a Tyk Security Policy to limit the number of requests an API key can make over a defined period. Unlike rate limits (requests per second), quotas control overall volume. We'll set a low quota limit with a short renewal period for easy testing, associate a key with the policy, observe blocked requests once the quota is exhausted, and verify that the quota resets after the period elapses. This guide primarily uses the Tyk Dashboard for configuration.
36
+
In this tutorial, we will configure Request Quotas on a [Tyk Security Policy](/api-management/policies) to limit the number of requests an API key can make over a defined period. Unlike [rate limits](/api-management/rate-limit) (requests per second), quotas control overall volume. We'll set a low quota limit with a short renewal period for easy testing, associate a key with the policy, observe blocked requests once the quota is exhausted, and verify that the quota resets after the period elapses. This guide primarily uses the Tyk Dashboard for configuration.
37
37
38
38
### Prerequisites
39
39
@@ -134,7 +134,7 @@ In this tutorial, we will configure Request Quotas on a Tyk Security Policy to l
134
134
2. Click the **Add Policy** button.
135
135
3. Under the **1. Access Rights** tab, in the **Add API Access Rule** section, select the `Request Quota Test` API.
136
136
4. Scroll down to the **Global Limits and Quota** section (still under the **1. Access Rights** tab):
137
-
***Important:** Disable **Rate Limiting** by selecting **Disable rate limiting** option, so it doesn't interfere with testing the quota.
137
+
***Important:** Disable **[Rate Limiting](/api-management/rate-limit)** by selecting **Disable rate limiting** option, so it doesn't interfere with testing the quota.
138
138
* Set the following values for `Usage Quotas`:
139
139
* Uncheck the `Unlimited requests` checkbox
140
140
* Enter `10` into the **Max Requests per period** field. (This is our low quota limit for testing).
@@ -388,7 +388,7 @@ Refer to the [Tyk Classic API Definition reference](/api-management/gateway-conf
388
388
389
389
### Configure via UI
390
390
391
-
The Tyk Dashboard provides a straightforward interface to set request quota parameters on Security Policies and Access Keys.
391
+
The Tyk Dashboard provides a straightforward interface to set request quota parameters on [Security Policies](/api-management/policies) and [Access Keys](/api-management/policies#access-key).
392
392
393
393
<Tabs>
394
394
@@ -491,15 +491,15 @@ The above adds quotas to an access key. Any request made by the key will behave
491
491
492
492
### Important Considerations
493
493
494
-
***Policy Precedence:** Quotas set on a Security Policy apply to all keys using that policy *unless* overridden by a specific quota set directly on the key (using the "Set per API Limits and Quota" option).
494
+
***Policy Precedence:** Quotas set on a [Security Policy](/api-management/policies) apply to all keys using that policy *unless* overridden by a specific quota set directly on the key (using the "Set per API Limits and Quota" option).
495
495
***Unlimited Quota:** Setting `quota_max` to `-1` grants unlimited requests for the quota period.
496
496
***Event-Driven Resets:** Quotas reset *after* the `quota_renewal_rate` (in seconds) has passed *and* upon the next request using the key. They do not reset automatically on a fixed schedule (e.g., precisely at midnight or the 1st of the month) unless external automation updates the session object.
497
497
***Response Headers:** When quotas are active, Tyk typically adds `X-RateLimit-Limit`, `X-RateLimit-Remaining`, and `X-RateLimit-Reset` headers to responses, allowing clients to track their usage. (Note: Header names might be configurable).
498
498
499
499
---
500
500
## How It Works
501
501
502
-
Request Quotas in Tyk limit a client's total number of API requests within a defined period (hours, days, months). Unlike rate limits that control the frequency of requests over short intervals (like seconds or minutes) to prevent immediate system overload, Request Quotas control the total volume of requests allowed over much longer periods to manage overall consumption and align with service tiers.
502
+
Request Quotas in Tyk limit a client's total number of API requests within a defined period (hours, days, months). Unlike [rate limits](/api-management/rate-limit) that control the frequency of requests over short intervals (like seconds or minutes) to prevent immediate system overload, Request Quotas control the total volume of requests allowed over much longer periods to manage overall consumption and align with service tiers.
503
503
504
504
When clients reach their quota limit, further requests are rejected until the quota period renews. It helps API providers implement usage-based pricing tiers, prevent API abuse, control infrastructure costs, and ensure fair resource distribution among clients.
505
505
@@ -519,7 +519,7 @@ flowchart LR
519
519
520
520
### How Tyk Implements Quotas
521
521
522
-
Tyk implements request quotas using a Redis-based counter mechanism with time-based expiration. Here's a detailed breakdown of the implementation:
522
+
Tyk implements request quotas using a [Redis](/tyk-configuration-reference/redis-cluster-sentinel)based counter mechanism with time-based expiration. Here's a detailed breakdown of the implementation:
523
523
524
524
```mermaid
525
525
graph LR
@@ -533,7 +533,7 @@ graph LR
533
533
534
534
#### Core Components
535
535
536
-
1.**Redis Storage**: Quotas are tracked in Redis using incrementing counters for each API key. The TTL is set to the quota renewal period, and the counter is reset to 0 on the next request after expiration.
536
+
1.**[Redis Storage](/tyk-configuration-reference/redis-cluster-sentinel)**: Quotas are tracked in Redis using incrementing counters for each API key. The TTL is set to the quota renewal period, and the counter is reset to 0 on the next request after expiration.
537
537
538
538
Here is a sample Redis key for a Request Quota:
539
539
```
@@ -612,7 +612,7 @@ The available allowance (`QuotaRemaining`) for an API key is replenished back to
612
612
613
613
#### Key Technical Aspects
614
614
615
-
1.**Time-Based Reset**: Unlike rate limiting, which uses sliding windows, quotas have a fixed renewal time determined by `QuotaRenewalRate` (in seconds)
615
+
1.**Time-Based Reset**: Unlike [rate limiting](/api-management/rate-limit), which uses sliding windows, quotas have a fixed renewal time determined by `QuotaRenewalRate` (in seconds)
616
616
617
617
2.**Atomic Operations**: Redis pipelining is used to ensure atomic increment and expiration setting:
618
618
@@ -630,7 +630,7 @@ Request Quotas in Tyk limit the total number of API requests a client can make w
630
630
631
631
<Accordiontitle='How do Request Quotas differ from Rate Limits?'>
632
632
While both control API usage, they serve different purposes:
633
-
-**Rate Limits** control the frequency of requests (e.g., 10 requests per second) to prevent traffic spikes and ensure consistent performance
633
+
-**[Rate Limits](/api-management/rate-limit)** control the frequency of requests (e.g., 10 requests per second) to prevent traffic spikes and ensure consistent performance
634
634
-**Request Quotas** control the total volume of requests over a longer period (e.g., 10,000 requests per month) to manage overall API consumption and often align with business/pricing models
0 commit comments