OctaFuse Gateway 2.9.0 Adds Dual-Layer Rate Limiting, Custom Upstream Headers, and Dashboard Overhaul

OctaFuse Gateway 2.9.0 focuses on day-to-day governance for shared gateways: controlling how many requests a user and each of their API keys can make, satisfying upstream providers that require specific headers, and giving administrators faster visibility into traffic and anomalies. Existing applications do not need to change request URLs or authentication methods.

01 | Dual-Layer Rate Limiting (User + Key RPM)

A single user often holds multiple API keys. Limiting only per key cannot cap the user's total volume; limiting only per user may let one misbehaving key consume the entire quota. Version 2.9.0 adds two independent RPM (requests per minute) limits:

User Aggregate RPM : caps the total requests from all of a user's API keys in the last 60 seconds.

Per-Key RPM : caps requests from that specific API key in the last 60 seconds.

For example, set the user aggregate limit to 120 RPM, the web application key to 80 RPM, and the automation task key to 30 RPM. No single key may exceed its own ceiling, and the sum across all keys may not exceed the user's shared ceiling.

Both limits are configured independently: leaving the field blank means unlimited, 0 denies all counted requests, and any other value must be a non-negative integer. The window is a sliding 60 seconds from the current moment — it does not reset at natural minute boundaries.

When a limit is exceeded, the gateway returns:

429 gateway.rate_limited
Retry-After: <seconds>

Clients can use the Retry-After header to decide when to retry. The GET /v1/me endpoint does not participate in either counter, so it remains available for quota status checks even when rate-limited.

Administrators configure the user aggregate RPM on the user detail page and view each key's limit status there; the API Keys page is used to set per-key limits. Both the management UI and the Admin API reject negative numbers and decimals.

OctaFuse user detail page configuring user-level RPM limit OctaFuse API Key edit window configuring per-key RPM limit Rate limiting answers "how many calls are allowed"; usage analysis answers "where do the requests come from". When a user's cost or request volume spikes, a user-level summary is often insufficient. 2.9.0 adds a Key-level analytics endpoint: <code>GET /api/admin/analytics/keys ?user_id=&lt;USER_ID&gt; &amp;start_date=&lt;START&gt; &amp;end_date=&lt;END&gt;</code> The endpoint returns, for the given time range, each key's request count, token usage, user billing, supplier cost, success rate, model count, and last active time. Portals or ops systems can break a user's total down to website, agent, automation tasks, etc. The model analytics endpoint also accepts api_key_id to view a single key's usage and cost per model. Beyond aggregates, the admin console can filter request logs by api_key_id . Logs now also record the Ingress Host — the actual domain the request arrived on. When one proxy serves production, staging, and multiple business entry points, this tells you which entry point a key's traffic came from. Ingress Host is for observation only; it is not a domain whitelist and does not participate in access control. On every successful usage write, the gateway updates the key's last_used_at timestamp, making it easy to identify long-unused keys. 02 | Custom Upstream Request Headers Some third-party providers require fixed HTTP headers beyond the API key. For instance, OpenRouter may use HTTP-Referer to identify the source site and X-Title to show the application name. 2.9.0 lets you configure such forwarding headers per route. In the Routes editor, add header names and values; the gateway will send them to the upstream with each request. OctaFuse route editor configuring upstream HTTP headers and JSON body defaults Route custom parameters split into two parts: left-side headers are sent as HTTP request headers; right-side parameters are merged into the upstream JSON request body. The two do not mix. When managing routes via the Admin API, these values are stored in custom_params.headers . They are sent only as HTTP headers and never merged into the JSON body. Authentication and transport headers remain under gateway control. The following cannot be overridden via route configuration, to avoid breaking provider auth or request forwarding: Authorization , X-API-Key , X-Goog-API-Key , Host , Content-Type , Content-Length , Cookie , and connection-management headers. The route's "request body" section is a separate configuration for providing JSON defaults such as temperature . When the client explicitly sends the same parameter, the client's value wins; therefore request-body defaults cannot be used to enforce hard parameter limits. After saving a route, the Playground's "Actual Upstream Request" view shows the final headers and body. Custom headers are marked distinctly, and sensitive values like API keys are automatically redacted. OctaFuse playground preview of custom upstream headers and final request body The playground marks headers originating from custom_params and simultaneously displays redacted auth info and the final upstream request body. 03 | Admin Dashboard Upgrades The new Dashboard consolidates request volume, success rate, average response time, user billing amount, trends, top models, active users, recent requests, and errors onto a single page. Operators can first assess overall health from the overview, then drill into model, provider, user, or reliability analyses. OctaFuse new dashboard showing request volume, success rate, average latency, billing amount, and traffic trends The new dashboard centralizes core runtime metrics and traffic trends, with support for common or custom time ranges. Model, provider, and user usage pages now allow expanding multiple rows simultaneously for side-by-side comparison, eliminating repeated collapse-and-switch cycles. Save, delete, and error feedback across the console have been unified to in-page notifications and confirmation dialogs, reducing browser alert interruptions. 04 | Other Updates Beyond the headline features, 2.9.0 includes the following catalog, deployment, and compatibility changes: Provider Onboarding : Added SiliconFlow international site template, clearly separating domestic and international accounts and endpoints; import and edit UIs now include links to the platform homepage or API key page. Model Catalog : Added gemini-3.8-flash ; filled in official peak-hour windows for DeepSeek V4 Pro and DeepSeek V4 Flash; corrected USD and CNY preset prices for 23 Alibaba Bailian models. Price Display : When multiple routes share the same priority and weight, the catalog shows the discount from the route with the lower current composite multiplier; actual request routing strategy is unchanged. Cloudflare Deployment : PROXY_CUSTOM_DOMAIN and ADMIN_CUSTOM_DOMAIN now accept comma-separated multiple domains; blank entries are ignored, duplicates are deduplicated, and the original single-domain syntax remains valid. Node / Docker Deployment : Fixed a false-positive 403 from same-origin checks when the admin console sits behind a reverse proxy during integration key creation or modification; genuine cross-site write attempts are still rejected. Billing Logs : Chat, Responses, Anthropic Messages, and Gemini now use a single structured billing pipeline; usage, errors, and upstream request IDs are normalized consistently; existing billing definitions are unchanged. Image Edits : Single reference image uses image ; multiple reference images use image[] , improving compatibility with different OpenAI-compatible upstreams. Models and providers already imported into the database are not automatically overwritten by the static catalog. To use new models, the international template, or updated prices, verify existing configuration first, then re-import or adjust manually. Upgrading to 2.9.0 This version includes database migration 0028 , which adds rate-limit configuration for users and API keys, adds the ingress host column to request logs, and creates corresponding indexes. D1, PostgreSQL, and MySQL use the same field semantics. Recommended upgrade sequence: Back up the target database. Run the 2.9.0 migrate image or equivalent command to apply migration 0028. Rolling upgrade Proxy and Admin to 2.9.0. Verify user aggregate RPM, per-key RPM, Retry-After header, and /v1/me exemption. Validate ingress host, key last-used time, and key-filtered results. Use the Playground to verify custom request headers, then regression-test Chat, Responses, Messages, Gemini, Images, and Audio routes. New migration columns are nullable; existing users and keys without a configured rate_limit remain unlimited. When rolling back, the new columns can be retained. Rate-limit windows are stored in each Proxy process's or Cloudflare isolate's memory and are not persisted to the database. In a single Node process the limit is near-exact; in multi-process, multi-replica, or multi-isolate environments, instances do not share windows, so the limit is a soft ceiling. A process restart resets the current window. For strict cross-instance global rate limiting, a centralized rate-limiting layer is still required. Before upgrading, review the GitHub Release v2.9.0 ( https://github.com/OctaFuse/octafuse-gateway/releases/tag/v2.9.0 ) and the full changelog ( https://github.com/OctaFuse/octafuse-gateway/blob/v2.9.0/CHANGELOG.md ). Summary 2.9.0 makes shared-gateway traffic governance and daily operations more complete: dual-layer RPM constrains both user totals and individual keys; custom forwarding headers satisfy diverse provider onboarding requirements; key-level analytics, ingress host tracking, and the new dashboard make traffic and anomalies easier to pinpoint. Upgrading requires applying migration 0028 and setting appropriate request rates for users and keys per business needs; existing applications do not need to change their calling patterns.