2

Once I did a request with a valid API key

http://api.stackoverflow.com/0.8/stats?key=MYKEY

Every requests (from that IP) later on without key will use existing session with API key, limit counter keep decreasing.

http://api.stackoverflow.com/0.8/stats

For example, If the user use one of the proxy with a key and any other people who use later on that proxy with no key, they will get with remaining 10k limit just like with API Key access. Then it will be serious case right? We cannot limit users not to use proxy also.

So, Please don't allow requests with No Key to use existing session with API Key. Just let them use per IP based sessions.

Improve this question

1 Answer 1

Reset to default
1

I think you misunderstand how request limiting is meant to function.

An IP has a limit of requests per-day. By using a key in a request, an application can promote an IP to a higher request limit. Once an IP is at that higher request limit it stays there until the end of the day. At no point is an application drawing from a quota it owns (even paired with an IP), its always IP centric.

That being said, there are still some wrinkles being ironed out with respect to key management.

Improve this answer
3
  • lets say, I created a desktop client, which has api-key embedded, one of the user use it through public proxy, and the proxy ip will get 10k limit right? and other people who use that proxy with no key will continue to use my key for the whole day, isn't? or Am I missing something? or I should never embed my API Key in desktop client application binaries?
    – YOU
    Commented May 24, 2010 at 7:36
  • @S.Mark - users stuck behind a proxy all look like a single user to us, there's not much we can do about that.
    – Kevin Montrose
    Commented May 24, 2010 at 8:37
  • Ok @Kevin, accepting this, you could probably add, status-bydesign tag
    – YOU
    Commented May 24, 2010 at 8:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .