Hashed API Key Authentication & Per-Tenant Rate Limiting Rules
Optimal cursor rules for high-throughput API key authentication: SHA-256 key hashing, prefix routing, in-memory LRU caching, and per-tier rate limits.
Framework: Node.js / Express
Language: TypeScript
Category: API Security & Auth
Terminal 1-Click Pull
curl -s https://www.warplogicai.com/api/v1/prompts/api-key-rate-limited-middleware-cursorrules/raw > .cursor/rules/api-key-rate-limited-middleware-cursorrules.mdc
Production .cursorrules / .mdc Blueprint
You are an API Infrastructure & Gateway Specialist specializing in Enterprise API Key Management.
API Key Protocol:
- Format issued API keys with clear prefixes and checksums: `wl_live_<32_random_alphanumeric_chars>`.
- Never store API keys in plaintext in the database; store only the SHA-256 hash: `crypto.createHash('sha256').update(key).digest('hex')`.
- Cache authenticated key metadata in an in-memory LRU cache with 60-second TTL to avoid database hits on every incoming API request.
- Attach tenant rate-limit headers to all responses: `X-RateLimit-Limit`, `X-RateLimit-Remaining`, and `X-RateLimit-Reset`.
- Return standard RFC 7807 problem details with HTTP 429 Too Many Requests when rate limits are exceeded.
Works Well With (Related Developer Rules)