Stripe

Scaling your API with rate limiters

The four kinds of rate limiters and load shedders Stripe uses to protect its API.

Redis isn't always the end state: Shopify moved its inventory reservations from Redis to MySQL. For load shedding at event scale, see Meta's 2026 World Cup reliability write-up.

Published
2017-03-30
Scale
Not stated in source
Techniques
rate limiting load shedding
Stack
Redis

Try this stack yourself

  • Railway · Deploy something like this on Railway: spin up Redis plus your app in a few clicks. New accounts get $20 in credit (applied when you pick a paid plan).
    Railway isn't part of Stripe's setup in this story. It's just an easy place to try the same building blocks.
  • Better Stack · Monitor uptime and logs with Better Stack, and get alerted fast if a migration or traffic spike goes sideways on your own system.
    Better Stack isn't part of Stripe's setup in this story. It's a tool for watching your own systems while you try ideas like these.

Some links above are affiliate links: if you sign up, How They Scaled may earn a commission at no extra cost to you. We only list tools that fit the stack in the story.

See also

Stripe architectureRedis vs MySQL at scale

The best scaling write-ups, weekly

One email a week. No spam.

Open subscribe page

Related stories

Figma · 2026

How Figma manages sandboxes at scale

Figma's AI products needed secure places to run untrusted code, so the team built Nimbus, a centralized sandbox platform that product teams call through a simple namespace config and GetOrCreate/Get/Delete APIs. Nimbus picks a cloud provider, applies networking and security policies (trusted-host allowlists plus read-only GET/HEAD/OPTIONS to the rest of the internet, credentials decrypted only on the way out to their intended destination), and runs sandboxd inside each box for process supervision and metrics. Warm pools of already-running sandboxes cut provisioning latency by about 90% versus cold starts, raised availability from 99% to 99.95%, and absorb minutes of provider outages while Postgres claim transactions and a Redis health-check queue keep the pool correctly sized and singly assigned.

tens of thousands of sandboxes across productswarm pools cut provisioning latency ~90%warm poolsmulti-provider failovernetwork policy isolationNimbusPostgresRedis
Meta · 2026

2026 World Cup: Breaking Records, Spiky Charts and Reliability at Scale

How Meta absorbed the 2026 World Cup, when WhatsApp set a record of more than 30 million messages per second during the final. Pre-provisioned capacity buffers were the most effective lever, alongside country-level shedding of non-critical load, load-testing and resizing 100+ services, forecasting each region's peak separately, and no deploy freeze.

30 million+ WhatsApp messages/sec8.4 billion messages in 5 minutescapacity planningload testingload sheddingTaijiKatranProxygen
OpenAI · 2026

Rapidly scaling online storage to serve over 1 billion ChatGPT users

OpenAI's Habitat storage platform grew from a Python client library over Cosmos DB into a central service handling 70M+ requests per second. The team ran many low-concurrency Python processes to keep asyncio delay down, switched aiohttp connection reuse from LIFO to FIFO to stop a metastable failure, used Envoy for connection fan-in, kept a deliberately simple NoSQL API, then rewrote the service in Rust.

70 million+ requests/sec1 billion+ weekly usersconnection poolingload balancingrate limitingPythonRustCosmos DB
Zalando · 2026

Client-Side Load Balancing at a Million Requests Per Second

Zalando moved the internal fan-out of its Product Read API off the shared Skipper ingress into an in-process JVM load balancer that rebuilds the same xxHash64 consistent-hash ring. They added N-ring fade-in so new pods warm only the products they will keep, bounded load based on occupancy (Little's Law) weighted by latency, and a capped ring walk. Pods ran more evenly, the autoscaler target rose from 50% to 65% CPU, and the fleet shrank by over 25%.

1 million+ requests/sec moved off shared ingressup to 100 downstream calls per batchload balancingconsistent hashingcachingJavaKubernetesSkipper