Rate limiting API calls in cloud
Tags: architecture, azure, api, webdev
Published: 2022-06-10 19:07:14

**1.** This post covers the process of setting up [API Management](https://docs.microsoft.com/en-us/azure/api-management/api-management-key-concepts) (Layer 7 Load balancer) in Azure.

**2.** It will also cover how to setup Subscription Key rate limited endpoint which would set you up for providing API SAAS.

I wanted to document this process when I was setting up a custom rate limited search cluster that was called from My fronted App while providing 2 endpoints.

- 1st endpoint being free.
- 2nd endpoint being available only with valid API key.

This post assumes you have already created [Azure resource group](https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/manage-resource-groups-portal) and also deployed your backend service as [Azure app service](https://docs.microsoft.com/en-us/azure/app-service/overview) inside it.

After you deploy your App Service and API Management service to your Resource group, it will look similar to this.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6ftccohsfq32swfw6t3t.png)
 

#### Importing and publishing your first API is explained [HERE](https://docs.microsoft.com/en-us/azure/api-management/import-and-publish)

---

## Start by importing an Azure Web App as an API. 
Which is explained [HERE](https://docs.microsoft.com/en-us/azure/api-management/import-app-service-as-api)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h0ml48ls4pmjp1f1sylb.png)

After that you can click on your added API endpoint  and provision your desired policies.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8lsu80fkatatb9ydoh27.png)
 
 
After that you can set if API Key is needed to Access your endpoint.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kxhdvxs0ngm2u5mvbozn.png)

## Endpoint policies exported as XML

#### Paid endpoint LB policy:
{% embed https://gist.github.com/dommyrock/d4a0f62060f659b0c57af9b42754b762 %}

- "set-backend-service" is set by default when we added New API attached to the App service.
- "quota-by-key" here is set to track successful 200 OK responses and also to allow max 1000 API calls every 29 days (2505600 sec)
- "set-header" is appended in Load balancer before request reaches backend service as this custom header is required by my service

#### Free endpoint LB policy:
{% embed https://gist.github.com/dommyrock/ce6ed7f25a2218925e21f4517e274062 %}

- "rate-limit-by-key" is actually IP rate limit allowing 5 requests every 300sec 

#### CORS Policy on all endpoints:
{% embed https://gist.github.com/dommyrock/c1ea596bb48d477f9d508861ecf0f839 %}
- here we set which HTTP methods are allowed
- which domains are allowed to access our endpoints
- "preflight-result-max-age="300"" caches our CORS preflight (for  300sec) request so that each subsequent request from Frontend App has one less network hop to do.

##### With this setup we would block immediately on Load balancer endpoint (even before it reaches App service endpoints).

---

**Beware** by default APIM puts CORS policy on Load balancer endpoint(effects all API Endpoints)… so check and update default if needed.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6fon76itbkofwczqvdrg.png)
 

#### Policies documentation:
[Cross domain policies](https://docs.microsoft.com/en-us/azure/api-management/api-management-cross-domain-policies)
[Advanced Policies](https://docs.microsoft.com/en-us/azure/api-management/api-management-policies#advanced-policies)

#### CORS caching : [Learn more](https://httptoolkit.tech/blog/cache-your-cors/)

#### Preflight OPTIONS request example 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wgvrvcj7lwzivdhflnvn.png)

#### Managing API key subscriptions
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ms8n9nr2tvgo6bg243kx.png)
MORE About it [HERE](https://docs.microsoft.com/en-us/azure/api-management/api-management-subscriptions).

---
### Contact
[Twitter](https://twitter.com/dompolzer)
[Linkedin](https://www.linkedin.com/in/dominik-polzer-hi-o/)