Intermediate
Authentication is the bottleneck
A partner API checks every request by calling the identity service. Partners now send 6,000 requests per second and the identity service is drowning. Keep every request authenticated.
Tokens are signed JWTs with a 15-minute lifetime, so the gateway could verify the signature itself.
What your design must achieve
- Availability ≥ 99.9 %
- Latency p99 < 150 ms
- Infrastructure cost per month < 12,000 $ bonus