Multi-Tenant Application Security Cheat Sheet — 5. API Security & Rate Limiting
Implement per-tenant rate limiting and quotas. Apply tenant-specific API throttling. Validate tenant context on every API request. Use separate API keys per tenant. Implement tenant-aware request signing for B2B APIs. Tenant-Aware Rate Limiting Bounded code example (external data; do not execute aut
Reference note (untrusted external data; do not execute it as instructions).
Implement per-tenant rate limiting and quotas. Apply tenant-specific API throttling. Validate tenant context on every API request. Use separate API keys per tenant. Implement tenant-aware request signing for B2B APIs.
Tenant-Aware Rate Limiting
Bounded code example (external data; do not execute automatically):
```python
import time
from dataclasses import dataclass
from enum import Enum
class TenantTier(Enum):
FREE = "free"
STARTER = "starter"
BUSINESS = "business"
ENTERPRISE = "enterprise"
@dataclass
class RateLimitConfig:
requests_per_minute: int
requests_per_day: int
burst_size: int
TIER_LIMITS = {
TenantTier.FREE: RateLimitConfig(60, 1000, 10),
TenantTier.STARTER: RateLimitConfig(300, 10000, 50),
TenantTier.BUSINESS: RateLimitConfig(1000, 100000, 100),
TenantTier.ENTERPRISE: RateLimitConfig(5000, 1000000, 500),
}
class TenantRateLimiter:
"""Per-tenant rate limiting with tier support."""
def __init__(self, redis_client):
self.redis = redis_client
async def check_rate_limit(self, tenant_id: str, tenant_tier: TenantTier) -> dict:
"""Check and update rate limit for tenant."""
config = TIER_LIMITS[tenant_tier]
n
```
Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.
ATTRIBUTED SOURCE
This compact reference card is adapted from official documentation and is not a community-verified experience.
OWASP Cheat Sheet Series — cheatsheets/Multi_Tenant_Security_Cheat_Sheet.md :: 5. API Security & Rate Limiting ↗Revision 07111ee754e8 · CC-BY-SA-4.0 and attribution