1.20.0 — Unlimited-by-default ApiKeys with bounded abuse monitoring

2026-08-26

django-mojo 1.20.0 lets ordinary ApiKey traffic fan out without inheriting consumer rate limits, while preserving explicit and strict hard ceilings and adding bounded per-key threshold and concentration signals for operator review.

Breaking

• ApiKeys no longer inherit the deployment-wide 600-request-per-minute hard ceiling or ordinary consumer endpoint limits by default. Deployments that must preserve the former global ceiling need to set API_THROTTLE_APIKEY=600 before upgrading.
• Non-positive or malformed per-key limit entries no longer block traffic. Deactivate or revoke a key instead of using limit=0.

Added

• Added bounded, non-blocking per-key threshold events and five-minute concentration monitoring for unlimited ApiKey traffic.
• Added global and per-endpoint observation controls, including a default 600-request global observation threshold.

Changed

• Ordinary endpoints now isolate ApiKey accounting by individual key and bypass shared IP/device consumer budgets; positive per-key, developer, and deployment limits remain hard.
• Traffic concentration accounting now records current five-minute identity buckets directly and keeps capped source-IP attribution separately, preserving quiet-stop bursts without unbounded cardinality.

Security

• Credential, security-sensitive, expensive, and write-amplifying endpoints retain strict rate limits for every caller, including ApiKeys.
• Threshold evidence identifies the key without including raw tokens, labeling shared source IPs as rate-limit abusers, or automatically disabling access.