API / Apollo Gateway Interview questions
How can you implement rate limiting at the Apollo Gateway or Router level?
The right approach differs a bit depending on whether you're running Router or the older Node.js Gateway.
Apollo Router supports request-level rate limiting directly in its configuration for GraphOS Enterprise plans, and can also be extended with a Rhai script or an external coprocessor that inspects each request's context and rejects/delays it based on custom logic (e.g., per-API-key limits).
# router.yaml (illustrative) rhai: scripts: ./scripts main: rate_limit.rhai
It's also common, with either Gateway or Router, to put an edge proxy or API gateway (Envoy, Kong, or a cloud load balancer) in front that does token-bucket rate limiting before a request ever reaches the federation layer.
Apollo Gateway, being "just" an Apollo Server data source layer, typically relies on an upstream Express/Fastify rate-limiting middleware, or an Apollo Server plugin that checks request context against a limiter (like a Redis-backed token bucket) before letting the request proceed to the query planner.
More Related questions...