Throttling & Quota by users - Token Management

Question

I would like to implement quotas for users accessing my API but I'm not sure the flow I have in mind is the way to do by simply reading documentation from several API management solutions.

Currently, my flow could be described as follows :

1. The user provides credentials to the app
2. The app calls my Authorization Server for validation. The token is returned to the user if successful.
3. In the following requests, the app will validate the token (Authorization header) against the Authorization Server before accessing the service.

My problem is that I cannot implement quotas based on tokens since my users would be able to get a new token to avoid the limit. According to your experience, is it possible to manage quota by users at the gateway level or should I change my API authentication method?

Best regards,

Answer 1

When we speak of api and token the most used model of communication is the protocol OAuth 2.0.

Through it, API users must authenticate to their respective OAuth authentication server (it could be a third-party server, eg facebook or google).

With the token in hand and this token is a token with a limited lifetime, the exposed API must validate this token against the OAuth resource server which will identify who will be the client / application that is requesting.

Therefore, using OAuth token it will be possible to identify the requester.

Regarding quota control if you will not use any API Management / Gateway market player (Ex: apigee) you must implement this control with a high-performance query engine. For a simpler solution a key value pair database could solve this problem (eg redis).