A few weeks ago, I decided to challenge myself and write a .NET interface to some basic Twitter functions which I then used to populate a Sitecore installation. However, that is a story for another day. The important issue here is that there are many people using third-party Twitter plug-ins and libraries (or even in extreme cases T-SQL queries), and they should know some basic information about how Twitter lets external parties access its services.
Twitter has an hourly request limit which is currently set at 100 requests per hour. They monitor this in one of two ways: either by IP address or by authenticated account. For the average user, this isn't a big deal, but be wary of client-side AJAX-driven plug-ins. If these are not using a caching mechanism locally on the server (writing to your database for instance), they are likely eating up at least one request every time someone accesses your page! If you surpass the 100 request limit, Twitter will deny your API request.
So, you ask all wide eyed and curious, how do I tell if my library is doing this?
The first thing you will need is cURL. Download the non-SSL version for your OS of choice (we won't need SSL functionality for Twitter), and then extract it and go to the directory.
Next, run the following command (on the client and server, hopefully they have separate public IP addresses):
curl http://twitter.com/account/rate_limit_status.json
This will return a result like the following:
{"remaining_hits":100,"hourly_limit":100,"reset_time":"Wed Feb 18 00:10:40 +0000 2009","reset_time_in_seconds":1234915840}
The important number here is the remaining_hits number. This represents the number of API hits you have left this hour. Next, try visiting your website's Twitter feed, and re-run the command to see how many hits you have left now. If the number goes down, this is bad. Your plug-in or library is using the non-authenticated method of accessing your Twitter feeds and it is performing no caching. Essentially, this means that if 100 people visit any twitter-enabled page of this sort (on your website or anyone else's) in an hour from the same IP address (or the same person 100 times), your plug-in will stop working. If the number goes down on the server, this means the client AJAX requests are asking the server to perform the call for them, which means you have a global 100 request per hour limit for all visitors of your website, instead of 100 requests per client's public IP Address.
If the number does not decrease, try running the following command (again on client and server):
curl --head -u username:password http://twitter.com/account/rate_limit_status.json
If this number goes down, this means that the plug-in or library is calling Twitter in authenticated mode. If this is on the server, this again means that all visitors of your website have a global limit of 100 calls to Twitter.
However, if this is on the client, this is the absolute worst case. This means that clients are calling the Twitter API directly using your credentials. Worse still, since these are sent in plain-text, anyone accessing your site can use a tool like HttpFox to grab your login credentials from the Request Header. If this is your case, I would change your Twitter password immediately and discontinue use of the affected plugin or library.
I hope everyone has learned something about Twitter and request limits today!