API Rate Limiting

[Ben Dodson]

Hey everyone,

As you know, we've been having a few stability issues with the app recently. After some investigation and code tweaking, we've discovered that there were a few people using the public API too hard which is why we made the decision to suspend it temporarily whilst we tested our core codebase. Now that is done, we've decided to open up the API again but we have had to block a couple of IP addresses and API keys as they were hitting us far too frequently.

We're very proud of our developer community but we can't have the public API impacting on our core infrastructure in such a way. To that end, we'll be making some significant changes behind the scenes to make us more resilient to what has basically been a DoS attack from some API keys. We'll also be looking at imposing some more general rules on what you can and can't do with the API (for example, we do not want you to crawl through users pouches to build up a database of item locations). In many instances, if something you are doing is being done by hitting the server 5 times a second, then we'd want to work with you to provide a better API that can give you what you need instantly rather than you having to creatively attack our API.

I'll post more details about those changes soon but in the meantime we'd ask you to please think carefully about what you are using your API key for. If it's to provide a service to everybody and you are making requests infrequently or in short bursts then you're probably fine. If you are using your full request limit every second of the day or you're building something that only helps certain users, then we have an issue.

Please get in touch if you're unclear on anything.

Ben