技术问询：将Zillow API请求与用户关联而非HTTP主机

Sounds like you're tackling a critical compliance and tracking update for your Zillow API-powered web app—shifting from per-HTTP-host request limiting to per-user is a smart move, especially since Zillow caps each subscriber (and their ZWSID) at 1000 daily requests. Here's how to rebuild that logic properly:

1. Bind User Accounts to Their ZWSID #

First, you need to tie each user's Zillow API key directly to their account in your system:

• Add an encrypted field to your user database (never store plaintext keys!) to save their ZWSID.
• Create a user-facing settings page where they can input and update their ZWSID.
• Validate the ZWSID on submission by making a lightweight test call to Zillow's API (like a GetSearchResults request with a dummy address) to confirm it's active and valid.

2. Build a Per-User Request Tracking System #

You’ll need to log and count requests per user (or per their ZWSID, since each key has its own limit) to enforce the 1000 daily cap:

• Set up a request log table with fields: user_id, zwsid, request_timestamp, api_endpoint.
• Add a middleware/request interceptor that runs before forwarding calls to Zillow:
  1. Fetch the current authenticated user’s ID and their stored ZWSID.
  2. Calculate how many requests that user (or ZWSID) has made in the current UTC day.
  3. If the count hits 1000, return a clear error: "You’ve reached your daily Zillow API request limit (1000/day). Please try again tomorrow."
• Use a daily scheduled job (e.g., at UTC midnight) to reset counts or archive old logs to keep your database efficient.

3. Rewrite Request Handling Logic #

Replace the old per-host logic with user-aware routing:

• Remove all code that references HTTP host for request tracking.
• When forwarding requests to Zillow, always inject the user’s stored ZWSID into the API call (never let the frontend pass this directly—keep all API traffic proxying through your backend to prevent key exposure).
• Ensure every request is tied to an authenticated user (no anonymous requests, since you can’t track limits for unregistered users).

4. Add User-Facing Transparency #

Help users stay within limits and avoid confusion:

• Display a real-time usage meter in the user dashboard: "Today's Zillow API Usage: X/1000 Requests"
• Include a note that their ZWSID’s limit is shared across all platforms they use it on (not just your app)—so if they’re using the same key elsewhere, those requests will eat into their 1000/day cap.

Key Compliance Note #

Zillow’s terms require subscribers to manage their own request limits, so accurate per-user/ZWSID tracking keeps you compliant and prevents users from hitting unexpected blocks (or getting their keys suspended for overuse).

内容的提问来源于stack exchange，提问作者spwisner