---
title: "1.20.0 — Unlimited-by-default ApiKeys with bounded abuse monitoring"
description: "django-mojo 1.20.0 lets ordinary ApiKey traffic fan out without inheriting consumer rate limits, while preserving explicit and strict hard ceilings and adding bounded per-key threshold and concentration signals for operator review."
date: "2026-08-26"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-20-0/"
---

django-mojo 1.20.0 lets ordinary ApiKey traffic fan out without inheriting consumer rate limits, while preserving explicit and strict hard ceilings and adding bounded per-key threshold and concentration signals for operator review.

### Breaking

- ApiKeys no longer inherit the deployment-wide 600-request-per-minute hard ceiling or ordinary consumer endpoint limits by default. Deployments that must preserve the former global ceiling need to set `API_THROTTLE_APIKEY=600` before upgrading.
- Non-positive or malformed per-key limit entries no longer block traffic. Deactivate or revoke a key instead of using `limit=0`.

### Added

- Added bounded, non-blocking per-key threshold events and five-minute concentration monitoring for unlimited ApiKey traffic.
- Added global and per-endpoint observation controls, including a default 600-request global observation threshold.

### Changed

- Ordinary endpoints now isolate ApiKey accounting by individual key and bypass shared IP/device consumer budgets; positive per-key, developer, and deployment limits remain hard.
- Traffic concentration accounting now records current five-minute identity buckets directly and keeps capped source-IP attribution separately, preserving quiet-stop bursts without unbounded cardinality.

### Security

- Credential, security-sensitive, expensive, and write-amplifying endpoints retain strict rate limits for every caller, including ApiKeys.
- Threshold evidence identifies the key without including raw tokens, labeling shared source IPs as rate-limit abusers, or automatically disabling access.