Skip to content

feat: Make request budgets configurable - #133

Open
SamyPesse wants to merge 3 commits into
workos:mainfrom
SamyPesse:codex/configurable-request-budget
Open

SamyPesse wants to merge 3 commits into
workos:mainfrom
SamyPesse:codex/configurable-request-budget

Conversation

@SamyPesse

@SamyPesse SamyPesse commented Oct 9, 2026 •

Copy link
Copy Markdown
Contributor

The fixed 1,000-request budget can throttle larger integration suites sharing one API key, causing SDK retries to wait for the next window. Add a positive-safe-integer requestsPerMinute option to createEmulator and the core server options, retaining the default of 1,000.

Each 60-second window now accepts the full configured budget. A budget of 1 permits one request; the last accepted request reports X-RateLimit-Remaining: 0, and subsequent requests receive HTTP 429 with Retry-After until the window resets. This addresses Greptile's smallest-budget finding and corrects the same boundary for default and larger budgets. The README documents configuration, headers, and window behavior.

Validation:

  • All 1,354 upstream tests pass, including 10 HTTP regression cases covering exact budget boundaries, API-key isolation, repeated exhaustion, the exact 60-second reset, larger budgets, and invalid options. The new boundary regressions reproduced the bug before the fix.
  • Build, type checks, lint, formatting, Node compatibility smoke, and package validation pass.
  • The branch is based on the latest upstream main (c63466f246b5060c766df4155676784543c7e171).
  • The downstream patch for published @workos/emulate@0.14.0 matches the four built runtime/type files byte for byte. A fresh frozen-lockfile installation, OpenKnowledge Compute's bun run check, all 22 backend integration scenarios, and the 10 HTTP regression cases against the installed patched package pass.

@SamyPesse SamyPesse changed the title Make request budgets configurable feat: Make request budgets configurable Oct 9, 2026
@SamyPesse
SamyPesse marked this pull request as ready for review October 9, 2026 15:03
@greptile-apps

greptile-apps Bot commented Oct 9, 2026 •

Copy link
Copy Markdown

RetriggerView in GreptileConfidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues remain.

Summary

Adds configurable request budgets while keeping the default of 1,000 requests per API key.

  • Each API key can use a configurable request budget.
  • CLI tests share one helper for running the process.

Reviews (3) · Last reviewed commit: "feat(cli): add --requests-per-minute and..." · Reviewed by Greptile

Comment thread src/core/server.ts
The configurable budget was reachable only through createEmulator,
so anyone running the CLI or the Docker image (whose entrypoint is
the CLI) was still pinned to 1,000 requests per key per minute. The
flag and WORKOS_EMULATE_REQUESTS_PER_MINUTE follow the precedence
the other flags use, with the flag winning over the environment so
a compose file can set a default a command can override.

The value is validated on the command line with the same rule
createServer enforces, so a bad budget fails naming the flag or
variable the user actually set rather than an option name from the
programmatic API.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants