One DNS record, and that's the integration
There is no SDK to install and no middleware to wire. Traffic comes in through the edge node and flows on to your backend, with two headers added on the way.
1 · Point your domain at the edge
api.yourcompany.com. CNAME edge-eu-1.quota.at.One record. Your certificate is issued and renewed at the edge; your origin keeps serving on whatever it serves on today.
2 · What your backend receives
| Header | Meaning |
|---|---|
x-quota-limit | Requests allowed in the current window for this client. |
x-quota-remaining | How many are left. Counts down to zero, then the 429s start. |
retry-after | Seconds until the window resets. Only on a 429. |
Nothing you're forced to parse: they're there for clients that want to back off politely. The enforcement happens at the edge either way.
3 · What the caller gets back
4 · The limits of each plan
| Plan | Requests / month | Sustained req/min | Request body cap | Individual requests kept |
|---|---|---|---|---|
| Micro | 200K | 20 | 8 KB | ~3 weeks |
| Starter | 2M | 200 | 20 KB | ~6 days |
| Pro | 15M | 1,000 · waitlist | 256 KB | ~2 days |
| Enterprise | 50M+ | 30,000+ | up to 1 MB | ~2 days |
The rate is the one you hit first. A plan with room to spare on the monthly figure can still throttle a spike: 20 req/min is about 860k a month if you could sustain it, and the monthly cap is 200k. Each plan also admits a burst of 20 requests so a page load gets through; the bucket then refills at the advertised rate. Size on the rate, not on the total. Pro is on the waitlist.
The cap is on what comes in, and it is fixed. Micro takes request bodies
up to 8 KB, Starter 20 KB, Pro 256 KB, and Enterprise up to 1 MB by agreement. An
oversized request comes back as 413, never reaches your backend, and does not
touch your monthly figure; it carries an X-Quota-Max-Payload header saying
what does fit, so you are not guessing. Responses are not capped. Whatever your backend returns goes straight
through at any size — streamed, never buffered and never truncated. The cap does not move
with your usage, and size does not change what a request costs: under the cap every request
counts as one.
5 · When something is wrong
You choose what an outage of ours means for you: fail open, and traffic reaches your backend unfiltered, or fail closed, and it stops at the edge. Per node, from the panel. Alerts reach you by email the moment one fires, with what tripped it and what the edge did about it.
Integration questions
Do I have to touch my backend?
No. Quota is a proxy that stands in front: you point traffic at the edge node and it forwards to your API. No SDKs, no middleware, no code changes.
What does my backend see with Quota in front?
Legitimate requests arrive as always, with headers added (x-quota-limit, x-quota-remaining). The excess gets a 429 with retry-after at the edge and never touches your origin.
How are the limits defined?
From the panel: per endpoint, per client or per plan. Quota detects your endpoints automatically and you set the rules for each one.
What if my backend lives on a local network?
That's what Quoxy is for — our ngrok-style proxy: it opens a secure tunnel from your network to the edge, so you stay self-hosted without exposing your API to the internet. It ships alongside Quota as a €55/mo add-on from Starter up, and Pro includes it at no extra cost.
Where do the nodes run?
In Europe today. North America and Asia-Pacific are on the roadmap. Every node is yours — you never share a queue with anyone.