#3 - Now i needed rate limiting because without it anyone could just spam the API and create like a million mailboxes which would be really bad. so i started looking into how to do this with cloudflare workers because thats what im using and they have this fancy Rate Limiting Binding that looked really clean. you just add some config to wrangler.toml, add the binding to your code, and boom - rate limiting.

so i added the bindings, deployed, tested… and nothing. like the binding was there, wrangler showed it in the deploy output, i could even see it in the cloudflare dashboard. but when i actually hit the API with like 8 requests in a row, every single one went through. no 429s, nothing.

i spent way too long on this. i was reading the docs, checking if my plan supported it, checking if the binding was actually being called, trying different keys… nothing worked. the binding just silently does nothing. like it deploys fine but then just… doesnt do anything? i dont even know whats wrong at this point.

so after giving up on the official way, i just went with D1. yeah the database. im literally storing rate limit counters in a sql table which is… not great for performance obviously because now every single request has to do a database query just to check if youre rate limited. but hey at least it actually works.

so right now every POST to /mailboxes does a SELECT on the rate_limits table, checks the count, either increments it or creates a new row, and THEN does the actual mailbox creation. so youre looking at like 2 extra database queries per request just for rate limiting. its not ideal but its what i got.

hopefully i figure out the cloudflare one someday because this is genuinely a worse solution in every way except that it works. but for now it prevents abuse so whatever.
anyway thats where im at. rate limiting works but its slow.