Rate Limiter

[hayesZach]

Closes CSF-1008
Closes CSF-1009

---

Note

Medium Risk
Touches request handling for core API routes and introduces enforcement that can block legitimate traffic if limits/key extraction are misconfigured, plus optional proxy-trust behavior that affects client IP attribution.

Overview
Adds an in-memory rate limiting middleware (ratelimit) based on API key or client IP, returning 429 with standard X-RateLimit-* headers (and Retry-After) and introducing new errors.Limiter/errors.RateLimited responses.

Applies API-key throttles to marketplace key management and reversals endpoints with route-specific limits, and adds optional TrustProxy config to honor Cloudflare’s CF-Connecting-IP header via new middleware.CloudflareIP when enabled. Includes dependency update (go-limiter) and comprehensive rate limit tests.

^{Written by Cursor Bugbot for commit 688fda8. This will update automatically on new commits. Configure here.}

[linear]

CSF-1008 Rate Limit Middleware

CSF-1009 Add Rate Limiting To Endpoints

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}