# Marcus Okonkwo, Senior Platform Engineer at Relay Financial — read of API Gateway AI, May 14 2026

> 9 years backend and infra, currently responsible for the API layer at a 110-person payments startup. I own our Kong setup, our Prometheus dashboards, and every post-mortem that starts with "a tenant hammered us."

## How I got here

Searched "adaptive rate limiting api gateway open source" on a Sunday evening because we had a tenant abuse incident Friday and our static quotas both failed in opposite directions — throttled a legitimate surge AND missed a credential stuffing run that lasted 40 minutes. Some subthread on Hacker News mentioned this page. Not an ad. Clicked out of curiosity, not intent to buy.

## What I clicked first

The hero copy actually stopped me. "Your static rate limits either leak abuse or block legitimate traffic" is the most accurate sentence I've read about this problem in months. That's not a marketing insight, that's a Friday post-mortem summary. The YAML block below the fold helped too — it's real config, not pseudocode, and the `baseline_window: 14d` and `sensitivity: 0.85` fields are specific enough that I can reason about them. That earned a few more minutes of my attention.

## Where I paused

The spec table. "Launch status: Early access, no live production customers yet." That's buried in a comparison grid below a hero that says "One early team cut unauthorized calls by 80 percent in their first week without blocking a single legitimate user." Those two things cannot both be true at the same time. Either you have an early team that ran it, or you have no live production customers. I read that twice. It reads like the case study was written before the product existed, which... I mean, maybe that's what happened.

## What I distrusted

Two things. First, that 80% claim with zero supporting detail. No tenant count, no traffic volume, no industry, no whether it was a demo environment or real prod traffic. The honest disclosure section literally says "we don't have live customers on this idea yet" and then the sentence right above it in the hero describes a customer outcome. That's not a small inconsistency.

Second, and this took me a minute to fully process: this isn't a product I can adopt. It's a product idea someone is selling ME to go build. The "Adopt the build" tier at $99-$199 gives me "working code starter, brand assets, copy library." The $5 tier unlocks a dossier with "first 7 build tasks." I came here looking for an API gateway I could drop in front of one service. I found a pitch deck for entrepreneurs who want to build API gateways. Those are completely different audiences and the page never clearly tells you which one you are until you've scrolled most of the way down.

## What would convince me

If this is being sold as a BUILD kit, I want to see the actual code starter. What does the adaptive engine actually look like? Is it a thin wrapper around something like Redis sliding window counters, or is there actual ML happening? "Learns per tenant traffic baselines over a 14 day window" could mean a Welford running average or it could mean a transformer model. Those have completely different infrastructure requirements. Show me 20 lines of the actual limiter implementation and I'd know immediately whether this is a real thing or a thin wrapper with a good name.

If somehow this IS meant to be a real product someone can deploy, I want one reference customer I can talk to. Not a case study PDF. A Slack community, a Discord, a "join 30 engineers using this." Something that suggests other engineers have looked at it and not immediately closed the tab.

## What I'd ask in an email reply

1. The spec says "14 day baseline window" and "per tenant sensitivity tuning" -- where does the baseline actually live? Redis? Postgres? In-memory? If my gateway restarts, do I lose 14 days of learning?

2. You say it "slots into the stack you already run" and lists Envoy and Istio in the integration logos. Does it actually interop with those, or is it a separate inline binary that replaces them? Because inline-between-clients-and-origin is a different architecture than sidecar, and you can't really do both.

3. The honest section says year-1 take-home is -$21K and odds of meaningful success are 1 in 8. Are you selling this as a product I use, or as a business idea I build? I genuinely am not sure after reading the whole page.

## Verdict: on-the-fence

The problem framing is accurate and the YAML is real. But I'm not sure what I'm being asked to buy and that's a fatal confusion for an infra tool. If you can clarify within two emails that this is an actual deployable binary I can run today, I'd keep talking.

---
*Memo by skeptic persona, generated 2026-05-14. Studio breaks own self-grading loop.*