Selling data by the request
Tidewell collects vessel positions, berth schedules and container events from more than 300 ports and sells them as an API to 640 freight forwarders, shippers and cargo insurers. Customers pay per call, so every request Tidewell serves is a line on an invoice.
That makes the request count the most important number in the company. For years, Tidewell had three of them.
Four systems, three versions of the truth
Keys lived in a Postgres table checked by custom middleware. Rate limits were nginx config blocks, one per customer tier, edited by hand and deployed with the rest of the infrastructure. Usage came from a nightly job that parsed load balancer logs, and request logs went to a separate vendor with three days of retention.
When a customer disputed an invoice, the billing count, the limiter's count and the log vendor's count rarely agreed. Resolving one dispute meant an engineer exporting logs into a spreadsheet, usually after the three-day retention had already dropped the requests in question.
One endpoint in an afternoon, all of them in nine days
The team started with vessel positions, their busiest endpoint, and had it serving production traffic through Halyard the same afternoon. Existing keys were imported as hashes, so none of the 640 customers had to change a credential.
Before enforcing the new limits, Tidewell ran them in shadow mode for three days. That surfaced eleven customers whose nightly syncs would have tripped the new per-minute limit. The team moved them to a higher tier first, then switched enforcement on. Nobody saw an unexpected 429. The remaining 139 endpoints followed over the next nine days.
Our invoices and our rate limits read from the same counter now. When a customer asks why they were billed, we send a link instead of a spreadsheet.
Invoices from the same counter
Halyard's per-key usage export feeds Tidewell's billing system directly, and customers see the same numbers in their own portal. Invoice disputes fell by 88% in the first full quarter, and the ones that remain are about pricing, not counts.
The on-call rotation changed too. Pages about the limiter or the auth middleware made up most of the alerts before the move; with both gone, pages dropped by 71%. When a customer accidentally pushed a live key to a public repository, rotating it with a 24-hour overlap took 40 minutes. The last time that happened, coordinating the swap had taken three days.