Use Cache API Instead of Workers KV for Rate Limiting

AI Summary · From the Perspective of a Serial Entrepreneur (The following content is distilled by AI; opinions belong to the original author; you can skip the original article after reading this)

A developer implementing rate limiting by installation ID hit Cloudflare’s account-level daily read quota ceiling of 100,000 due to high-frequency KV read operations, causing a complete outage across the entire account. By switching to the Cache API for high-frequency reads and Durable Objects for state storage, the hot and cold paths were decoupled, completely resolving the cascading failures caused by quota exhaustion.

• KV account-level daily 100k read quota is an implicit red line…
• For hot-path reads that don’t require strong consistency, prefer the Cache API, which doesn’t consume quota
• Defensive layers (like rate limiters) must be designed to 'fail-open'…
• Use Durable Objects to handle state reads and writes…

Background: The Overlooked Quota Red Line

While developing a status display service based on Claude Code, each installation instance polled the API every 10–20 seconds. This high-frequency access pattern performed fine during testing but caused severe failures under small-scale concurrency in production.

The initial rate-limiting code directly used Workers KV for reading and writing counts. Since KV quotas are calculated at the account level (100,000 gets per day) rather than per namespace or key, these pure rate-limit check requests quickly consumed the free tier’s daily quota limit.

Symptoms: Silent Collapse

Once the quota is exhausted, all KV operations under the entire Cloudflare account throw hard errors. This means not only does the rate-limiting logic fail, but normal business data reads are also interrupted simultaneously. The system ran normally right up until the moment the quota was exhausted, after which all requests simultaneously returned 500 errors.

Solution: Separating Hot and Cold Paths

Step 1: Replace Rate-Limit Reads with the Cache API
The rate-limit check essentially only needs to know

Original · DEV Community: Read original article →