Django Ninja - Storing total API request from user, Limit and Filter it

Question

I'm new to django, i'm currently working with API using Django Ninja Rest Framework .
in this example, users will have a unique APIKey each time i create new APIKey from this model and attach it to selected user.

this is my APIKey model:

### NOTE - This is just for testing, Not a real model, see the link below

class APIKey(models.Model):
    key         = models.CharField(max_length=64) # i know this should be unique, just for demo :)
    user        = models.ForeignKey(get_user_model(), related_name='free_key', on_delete=models.CASCADE)
    label       = models.CharField(max_length=40)
    revoked     = models.BooleanField(default=False)
    created_at  = models.DateTimeField(auto_now_add=True)
    expires_at  = models.DateTimeField(null=True, blank=True)

This model is just for testing purposes , I actually use this for my project and modify it.

So, My API endpoints need an API key for authentication (the API key that i have created that correspond to a specific user),
then i implement and follow the steps here and it works normally

My questions are:

1. Each user has a unique API key. How to count and store the total request from a user each time user makes a request to an endpoint? Should i add request_total field to my APIKey model or create a new Model? Should i use custom middleware? or should i use Redis or something? if so, how to implement it?

2. What's the best way for this scenario to implement a daily limit by the total request from a user? for example , the user daily limit request is 100 requests, and reset every 00:01AM

3. According to question number 1, what's the recommended way to filter the total request and show it to the corresponding user? for example , in Django Views, showing the total request each day from the last 7 days

As a piece of additional information , my API endpoints are mostly GET method and perform a function call, do some calculation or something, and return some data, not querying the database (Model.objects.get(id=id), etc...) ,

I apologize if my question doesn't make any sense, Thankyou...

Answer 1

I would do the following

1. inside authentication - create new object in database:

class ApiRequest(models.Model): key = models.ForeignKey(APIKey) timestamp = models.DateTimeField(auto_now_add=True, db_index=True)

2. After saving - you can count how many requests was during the day (or 24 hours) - and if more than 100 - return 403 forbidden