I'll add my hat to the pile of people unhappy about 1. the lack of an email notice, and 2. the sudden change (less than 30 days is a waaaay too small window).
However, there's a critical flaw in the API limits as currently set (2 per second) - the "failed auth / auth challenge" request is being counted! So for the old client (published by you guys), it does a request, gets an auth challenge, then immediately does a second request w/ the http basic auth header. These auth-challenge requests are counting - which means the probability of hitting the 2/sec limit is very very high.
Either increase the default to 4 per second, or make the auth-challenge responses NOT count toward the limit. I am having to do a major re-write to the API client library to make the auth be pre-emptively included. I had already spent several days implementing a RequestInterceptor to comply with the earlier limiting algorithm (which included feedback on how many req's were being made so I could throttle).
grrrrrr. coder-bear is grumpy!
I understand the needs for limits, we have them too, so the real grumpiness here is the speed of the change and the oversight of the http-basic-auth-challenge req/resp.
To the devs doing a try-try-try-again-till-it-works approach, you're still putting load on shopify servers, so at least don't try until a whole second has passed. I could see hitting the servers every 10ms with a new request, and they'd still be burning CPU on checking the /sec rate limit.
To shopify devs: have you considered simply pausing the request and answering it only when the 1-second limit has passed? By blocking the request, it provides natural "back-pressure" to the callers (that would be us), without the need for added code on our side. Plus, it will reduce bandwidth, since you don't waste bytes transmitted twice by us, and the bytes sent to tell us to "come back in a second". No code changes in the field. Reduced bandwidth. Happy dev community. Profit. :)