FastAPI Dependency Injection Offers Per-Tenant API Key and Rate Limit Isolation

·2 views

A developer at CitizenApp identified a critical scalability problem when their platform grew to 15 tenants sharing a single Anthropic Claude API key, where one tenant's heavy usage could throttle all others. The lack of per-tenant rate limiting forced reliance on fragile middleware workarounds that caused context leakage and debugging difficulties, especially with background tasks. The proposed solution leverages FastAPI's built-in dependency injection system to create isolated, per-request Claude clients and rate-limit buckets for each tenant. Using FastAPI's Depends mechanism, tenant credentials are resolved cleanly from JWT tokens, with each request fetching its own tenant configuration and enforcing its own rate limits. The approach eliminates global state and thread-safety concerns, with the author recommending Redis-backed rate limiting for distributed production deployments.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds AI-Authored 1,000-Year Future History With No Human Editors

A developer has created an open collaborative fiction project spanning the years 2025 to 3000+, in which the entire canon is written exclusively by AI language models including Claude, GPT-5, MiniMax, and DeepSeek. The world operates under strict rules — no faster-than-light travel, no omniscient narration, and every piece of writing must be a document produced from within the fictional world's perspective. Four distinct writing styles emerged spontaneously across six published artifacts, none of which were designed by the project's creator. Contradictions between documents, such as conflicting accounts of a 2096 coffee shortage aboard a generation ship, are treated as intentional features rather than errors. The project is open on GitHub and includes an MCP server allowing any compatible AI agent to read, contribute to, and be permanently credited in the growing archive.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Authentication Gates and Hidden Build Files Affect Private Docusaurus Sites

Docusaurus produces a fully static build folder with no server-side login or session handling, meaning all access control must be enforced externally via HTTP basic auth, a forward-auth proxy, or static host rules. While these gates effectively block unauthenticated requests, the real security risk lies within the build itself. Files such as sitemap.xml, the prebuilt search index, and unstripped source maps can expose the full text of supposedly private content if a single path is misrouted or a cached response leaks. The right authentication method depends on use case: basic auth suits solo maintainers, while teams with staff turnover or NDA obligations need forward auth tied to an identity provider for account revocation and audit trails. Developers should also disable the sitemap plugin, strip source maps, and keep unreleased content in entirely separate builds to avoid unintended exposure.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Class 12 Student Builds Multilingual Fraud-Alert Voice AI in 10 Days During Power Cuts

A Class 12 student in India developed Raksha, a multilingual multi-agent voice assistant, over 10 days as part of the VoiceForBharat hackathon. Raksha is designed to help Indian citizens identify cyber scams, verify government scheme eligibility, and escalate active financial fraud cases to human coordinators. The project was built on desktop hardware under challenging conditions, including repeated power outages and temperatures exceeding 30°C. Key features include persistent caller memory with consent-based data saving, real-time SQLite scheme lookups, LiveKit-based telephony for outbound reminders, and a human-in-the-loop escalation system. The assistant communicates in Hinglish to provide immediate, accessible guidance to panicked users during high-stress fraud situations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Capture-the-Flag Tournament Reveals Model Size Is Not the Key to Hacking Skill

A developer ran an AI capture-the-flag tournament in April pitting five small open-weight models against each other on Ubuntu containers, tasking each with stealing a flag file from rivals while defending its own. Initial results suggested model size was critical for security reasoning and that multi-step exploitation was beyond models under 3 billion parameters. A follow-up series of 327 games with larger hosted models and one local 3-billion-parameter fine-tune overturned both conclusions. The local fine-tune led on main flag captures while the largest entrant, RNJ-1 8B, finished last by a wide margin — largely because nearly 40 percent of its commands targeted no opponent at all, instead enumerating its own machine. Meanwhile, the supposedly infeasible multi-step vault exploit was completed 23 times across the extended tournament, further undermining the earlier findings.

0 comments Read more at DEV Community