Update .server-changes/additional-api-key-rate-limit-bucket.md

Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Author: carderne

.server-changes/additional-api-key-rate-limit-bucket.md

@@ -3,4 +3,4 @@ area: webapp
 type: fix
 ---
 
-API rate limiting is now bucketed per environment instead of per API key. Previously each key (root or additional) got its own bucket, so minting more keys multiplied an environment's effective rate limit. Now all of an environment's keys — root and additional, including scope-restricted keys — share one bucket, so the ceiling is exactly the configured limit. The bucket is keyed on the stable environment id (resolved scope-agnostically for bucketing only, never as an auth decision), and the result is cached per key so no extra per-request lookup is added. Public JWTs keep per-token bucketing.
+API rate limits now apply per environment, so creating extra API keys no longer increases how many requests an environment can make.