I turned my RapidAPI security infra into a starter kit (gateway auth + anti-SSRF + rate limiting for
https://josecoder.gumroad.com/l/dxrfou
Stop rebuilding the same RapidAPI security plumbing for every API you publishThis is a production-extracted FastAPI template with the infrastructure every RapidAPI provider needs and almost nobody wants to build twice: gateway-secret verification, anti-SSRF protection, distributed rate limiting, a circuit breaker, caching, observability, CI, and a hardened Docker image. Clone it, write your endpoint, ship.This is not a tutorial repo. It's extracted from a live production API currently running on RapidAPI, not written as a demo. The infrastructure test suite (SSRF matrix, rate limiting, circuit breaking, caching, observability, 39 tests) is the actual suite that runs in that API's CI on every commit.The two problems this solvesWithout gateway-secret verification, anyone who finds your backend's real URL (rarely hidden: a leaked log line, a Host header, a curious subscriber) can call it directly and skip RapidAPI's billing entirely. That's not hypothetical: a 2024 academic study of the RapidAPI ecosystem found thousands of leaked provider API keys and widespread security gaps across listed APIs.Without SSRF protection, any endpoint that accepts a URL parameter is a pivot point into your own private network or your cloud provider's metadata endpoint. The single most common way a fetch-this-URL-for-me API turns into a security incident.What's insideGateway verification: one dependency locks any route to RapidAPI's gateway only.Anti-SSRF shield: DNS resolved once and IP-pinned, every resolved address checked against private/loopback/link-local/reserved/cloud-metadata ranges, every redirect hop re-validated from scratch.Supporting infrastructure: Redis-backed distributed rate limiter with automatic local fallback, per-host circuit breaker, per-host outbound concurrency limiter, L1 result cache with single-flight coalescing, structured JSON logging with automatic secret redaction, Prometheus metrics and health endpoints.Ops, not just code: CI with lint, type-check, dependency CVE scan, SAST, full test suite, Redis integration test, and Docker build+healthcheck on every push. Multi-stage non-root Dockerfile and GHCR publish workflow.Where your code goesCopy the pattern in the example endpoint for every route you add. Your business logic goes in its own module, kept separate from HTTP concerns so it's testable on its own.FAQDoes this include business logic out of the box? No, this is infrastructure only.Can I use this for more than one API? Yes, one license covers unlimited products you build with it.Requirements: Python 3.11+. Redis optional (falls back to an in-process limiter automatically if unset).
