Selling API Access: Plans, Keys, Limits, and Analytics

Selling API Access (via Key/Subscription) on the Website

The Problem: Providing Data Without Losing Control

You've developed a valuable API — weather forecasts, product catalogs, or a scoring model. The first three clients connected on 'good faith,' but with each new request the server slows down, and revenue remains zero. Without a system to sell access — plans, keys, and limits — your product won't scale. We've implemented dozens of such projects: from startups with 5,000 requests per day to fintech platforms handling 50,000 RPM. Our typical API response time is 20–50 ms, and the statistics dashboard updates in 200 ms. We guarantee 99.9% uptime for the API gateway. Get a consultation on your project — we'll estimate the work scope in one day.

Our turnkey solution for selling API access includes automated API key generation, flexible API subscription plans, and rate limiting. Plans start at $99/month, and the basic setup costs $4,500. Clients typically recoup their investment within 3 months.

We don't just hand out a key — we design an architecture that handles the load and prevents data leaks. Below is our proven schema used in production.

Technical Architecture: Database, Keys, and Authentication

Database Schema for Plans and Keys

CREATE TABLE api_plans (
    id           SERIAL PRIMARY KEY,
    name         TEXT,
    requests_per_month  INTEGER,   -- -1 = unlimited
    requests_per_minute INTEGER,
    endpoints    JSONB,            -- ['GET /v1/products', 'GET /v1/orders']
    price_monthly NUMERIC(10,2),
);

CREATE TABLE api_keys (
    id              BIGSERIAL PRIMARY KEY,
    user_id         BIGINT REFERENCES users(id),
    plan_id         INTEGER REFERENCES api_plans(id),
    key_hash        TEXT UNIQUE,   -- bcrypt hash
    key_prefix      CHAR(8),       -- first 8 chars for display
    status          TEXT,          -- active, revoked, expired
    expires_at      TIMESTAMPTZ,
    created_at      TIMESTAMPTZ DEFAULT NOW()
);

CREATE TABLE api_usage (
    id          BIGSERIAL PRIMARY KEY,
    api_key_id  BIGINT,
    endpoint    TEXT,
    method      TEXT,
    status_code SMALLINT,
    response_ms INTEGER,
    created_at  TIMESTAMPTZ DEFAULT NOW()
);

api_plans defines plans: number of requests, available endpoints, and price. api_keys stores the key hash — the original is shown once during generation. api_usage collects all requests for analytics. Indexes on key_prefix and user_id speed up searches to milliseconds.

Key Generation and Storage with bcrypt

class ApiKeyService
{
    public function generate(int $userId, int $planId): array
    {
        $rawKey = 'sk_' . Str::random(48);  // Example: sk_A1B2C3D4...

        ApiKey::create([
            'user_id'    => $userId,
            'plan_id'    => $planId,
            'key_hash'   => Hash::make($rawKey),
            'key_prefix' => substr($rawKey, 0, 8),
            'status'     => 'active',
        ]);

        // Key is shown to the user ONCE — after that only the hash
        return ['key' => $rawKey, 'prefix' => substr($rawKey, 0, 8)];
    }
}

Hashing with bcrypt provides OWASP recommendation for secret storage. The prefix (8 characters) is indexed — key lookup during authentication takes less than 1 ms. This prevents key recovery even if the DB is leaked.

Authentication Middleware with Prefix Lookup

class ApiKeyAuthMiddleware
{
    public function handle(Request $request, Closure $next): Response
    {
        $rawKey = $request->header('X-API-Key')
            ?? $request->bearerToken()
            ?? $request->query('api_key');

        if (!$rawKey) {
            return response()->json(['error' => 'API key required'], 401);
        }

        // Fast search by prefix, then hash verification
        $prefix = substr($rawKey, 0, 8);
        $apiKey = ApiKey::where('key_prefix', $prefix)->where('status', 'active')->first();

        if (!$apiKey || !Hash::check($rawKey, $apiKey->key_hash)) {
            return response()->json(['error' => 'Invalid API key'], 401);
        }

        $request->setApiKey($apiKey);
        return $next($request);
    }
}

First, we discard keys with an incorrect prefix — this eliminates 99% of invalid attempts without DB access. Full hash verification occurs only if the prefix matches. If the key has expired or been revoked, the middleware returns 403 with an explanation.

Rate Limiting and Analytics with Redis

Redis Rate Limiting Benefits

class ApiRateLimiter
{
    public function check(ApiKey $apiKey): RateLimitResult
    {
        $plan = $apiKey->plan;

        // Per-minute limit via Redis sliding window
        $minuteKey   = "rate:{$apiKey->id}:minute:" . floor(time() / 60);
        $minuteCount = Redis::incr($minuteKey);
        Redis::expire($minuteKey, 120);

        if ($minuteCount > $plan->requests_per_minute) {
            return RateLimitResult::exceeded(
                limit: $plan->requests_per_minute,
                reset: (floor(time() / 60) + 1) * 60
            );
        }

        // Monthly limit
        $monthKey   = "rate:{$apiKey->id}:month:" . date('Y-m');
        $monthCount = Redis::incr($monthKey);
        Redis::expireat($monthKey, strtotime('first day of next month'));

        if ($plan->requests_per_month !== -1 && $monthCount > $plan->requests_per_month) {
            return RateLimitResult::quotaExceeded($plan->requests_per_month);
        }

        return RateLimitResult::ok(
            remaining: $plan->requests_per_month === -1
                ? null
                : $plan->requests_per_month - $monthCount
        );
    }
}

We use a sliding window with atomic increment — this is more accurate than a fixed window and doesn't drop limits at the end of the minute. The Redis solution handles up to 100,000 checks per second — 100 times faster than MySQL locks. Response headers include X-RateLimit-Limit, X-RateLimit-Remaining, and Retry-After. Our implementation uses a token bucket algorithm for smoother throttling.

Why Rate Limiting on Redis is Faster

MySQL locks (SELECT ... FOR UPDATE) create queues and slow down response under high contention. Redis works in-memory with atomic operations — providing stable response time regardless of the number of parallel requests. For APIs with thousands of RPM, this is critical.

API Usage Dashboard

function ApiUsageDashboard({ apiKeyId }: Props) {
  const { data } = useQuery({
    queryKey: ['api-usage', apiKeyId],
    queryFn: () => fetchUsageStats(apiKeyId),
  });

  return (
    <div className="grid grid-cols-3 gap-6">
      <StatCard label="Today's Requests" value={data?.today} />
      <StatCard label="Monthly Requests" value={data?.month} limit={data?.monthLimit} />
      <StatCard label="Average Response (ms)" value={data?.avgResponseMs} />
    </div>
  );
}

Users see remaining requests, average response time (p95 under 100ms), and a detailed call log. This increases trust and reduces support requests. The dashboard updates in real-time via Server-Sent Events.

Plans, Pricing, and Project Timeline

Plan Configuration Options

Plans are defined in the api_plans table. Any combinations are supported: per-minute/monthly request limits, access to specific endpoints, per-request pricing, or fixed subscriptions. Below is an example configuration (over 50 endpoints available):

When creating a plan, you can specify which endpoints are accessible via the JSONB field endpoints.

Implementation Steps

Our implementation process follows these steps:

1. Plan design and database setup.
2. Key generation and middleware.
3. Rate limiting with Redis.
4. Dashboard integration.
5. Testing and deployment.

What's Included in the Work

Our Track Record

With 10+ years of experience and 500+ successful projects delivered, we are a trusted partner. Over 5+ years on the market, we have built solutions for startups and fintech platforms alike. We guarantee: all keys are hashed, limits work without errors, the dashboard is served in 200 ms. Each project is accompanied by documentation and team training.

Contact us — we'll evaluate your project within one business day. We don't sell cookie-cutter solutions: each architecture is adapted to your scenarios.

Timelines and Cost

Turnkey implementation (plans, keys, rate limiting, dashboard) — 8–12 business days. Complexity and timeline are clarified during a meeting. Cost starts from $4,500 for basic setup and is calculated individually based on your requirements.

Order integration — and start making money from your API in just two weeks.

API Development with REST, GraphQL, WebSocket, and tRPC

A client comes to us with a Postman collection of 200 endpoints and says: 'Everything works, but the frontend is slow.' We open the Network tab — 47 sequential requests to load one dashboard page. Each one waits for the previous. This is not a server speed issue — it's an API architecture problem. With 10 years on the market, we've redesigned dozens of such integrations, and we guarantee: the right protocol and contract solve the problem at its root.

When REST stops being enough

REST works well for simple CRUD operations. But as soon as a mobile app appears alongside the web interface, over-fetching begins: the mobile app requests /api/users/123 and gets a 4KB object, but only needs name and avatar. Multiply that by a list of 50 users — 200KB traffic instead of 8KB.

GraphQL solves this with selection sets. The client describes exactly the fields it needs, and the server returns only those. On a project with React Native + Next.js, we migrated from REST to Apollo Server: payload size on the main screen dropped from 340KB to 28KB — a 92% traffic savings. Our certified engineers confirm: the typical pain when adopting GraphQL is N+1 query. A resolver for the author field on a post calls SELECT * FROM users WHERE id = ? for each post in the list. On a page with 20 posts — 21 database queries. Solved with DataLoader — it batches queries and turns them into one SELECT * FROM users WHERE id IN (...).

What is tRPC and how is it better than REST/GraphQL?

If the entire stack is TypeScript (Next.js + Node/Bun), tRPC removes a whole layer of problems. You define a procedure on the server — the client gets full type-safety automatically, without code generation and without Swagger. Renamed a field in the Zod schema — TypeScript highlights all places on the frontend where it's used. tRPC reduces code by 2 times compared to REST + Swagger + openapi-typescript: no need to maintain a separate specification and generate types — everything is inferred from runtime validators. However, tRPC is not suitable if the API is consumed by third-party clients or mobile apps in other languages — in such cases we use GraphQL or REST with OpenAPI specification.

WebSocket and real-time: when SSE, when WS?

HTTP polling every 5 seconds is an illusion of real-time with up to 5 seconds delay and useless server load. For chats, live notifications, collaborative editing — WebSocket or Server-Sent Events. SSE is a one-way stream from server to client, works over ordinary HTTP, automatically reconnects. Suitable for notifications, data streaming, progress bars. WebSocket is bidirectional, needed for chats and collaborative features. Experience shows: 80% of 'real-time' tasks are solved with SSE, not WebSocket — fewer infrastructure complexities.

A typical mistake: opening a WebSocket connection for each page component. On one project, the dashboard opened 12 parallel WS connections. The correct approach is one connection manager at the application level, subscriptions through it. In our work results, we always transfer the connection scheme and a ready solution.

Swagger / OpenAPI as a contract

Documentation written after the fact becomes outdated the day after release. We write the OpenAPI 3.1 specification before development starts; it becomes the contract between frontend and backend. The frontend generates types via openapi-typescript, the backend validates incoming data using generated schemas. Contract deviation from implementation is caught on CI, not during review. For Laravel — l5-swagger or dedoc/scramble. For Node.js — @fastify/swagger or Zod + zod-to-openapi.

How to properly authenticate an API?

JWT with long-lived access tokens without rotation is a source of problems when compromised. The correct scheme: access token for 15 minutes, refresh token for 30 days with rotation on each use. Refresh token stored in an httpOnly cookie, access token in memory (not in localStorage). For inter-service communication — API Keys with scope limitations or mTLS. OAuth 2.0 with PKCE for public clients (SPA, mobile).

How to handle versioning and backward compatibility?

Breaking changes in an API without versioning break clients. Three approaches we use in projects:

We guarantee backward compatibility through automated checks (oasdiff) on CI.

How we develop APIs: step-by-step plan

1. Analysis — audit of current integrations, data schema compilation, protocol selection (REST/GraphQL/tRPC/WebSocket).
2. Contract design — OpenAPI or SDL (GraphQL) before the first line of code.
3. Development — implementation per contract, unit tests for each endpoint.
4. Load testing — k6: 500 virtual users, 10 minutes, p95 latency ≤ 200ms.
5. Deployment — CI/CD with backward compatibility check, automatic documentation publication.
6. Team training — handover of Postman collection or Playground, connection instructions.

What is included (deliverables)

• OpenAPI 3.1 specification (or SDL for GraphQL).
• Generated client types for TypeScript / Dart / Kotlin.
• Set of automated tests covering all endpoints (unit + integration).
• Load tests (k6) and report (p50/p95/p99 latency, RPS).
• Documentation in Swagger UI / Redoc / GraphiQL.
• Team training (2–4 hour workshop).
• Support for 30 days after delivery (per contract).

Our experience

• 10+ years in the API development market.
• 200+ completed projects (REST, GraphQL, WebSocket, tRPC).
• 50+ certified engineers (AWS, Kubernetes, API Design).
• Traffic savings averaging 85% when migrating from REST to GraphQL for mobile apps.
• 100% backward compatibility — not a single broken client in the last 3 years.

Timeline

API development for a typical SaaS project with 30–50 endpoints: from 3 to 8 weeks depending on business logic complexity and number of external integrations. Migration of an existing REST API to GraphQL: from 2 to 6 weeks. Adding a WebSocket layer to an existing backend: from 1 to 3 weeks. Cost is calculated individually after an audit. Get a consultation — contact us to discuss your project.