Page MenuHomePhabricator

[API Gateway] Administrator limits number of client IDs per Client Developer
Closed, DeclinedPublic

Description

"As an Administrator, I want to limit the number of client IDs that each Client Developer can register, to prevent misuse of the authentication system."

A typical form of misuse would be registering multiple client IDs for the same app to get around API rate limits. Another form would be overloading the client ID approval process.

@BPirkle checked the database and found a max number of client IDs per developer account at 56. We think 100 client IDs should cover legitimate needs for most developers, but this should probably be configurable by a user right.

Event Timeline

This is an important user story for public launch, and we probably shouldn't go public without it.

Aklapper renamed this task from Administrator limits number of client IDs per Client Developer to [API Gateway] Administrator limits number of client IDs per Client Developer.Apr 1 2024, 8:10 AM
Aklapper removed a subscriber: • eprodromou.

As API Gateway is nowadays owned by ServiceOps, adding the ServiceOps project tag to open API Gateway tasks tagged with the deprecated/archived "Platform Team Initiatives (API Gateway)" tag at https://phabricator.wikimedia.org/project/profile/4321/, as part of Phabricator Housekeeping.

Krinkle subscribed.

Closing planning tasks from the "Core Platform Team" that was reorged in 2023 (i.e. not bugs or feature requests for current software). Note that the "API Gateway" was shutdown earlier this year in 2026. See also https://www.mediawiki.org/wiki/Core_Platform_Team and https://wikitech.wikimedia.org/wiki/API_Gateway.