Rate Limiting

Rate limiting controls the rate at which clients can consume an API or service. By rejecting or delaying requests that exceed a defined quota, it prevents any single client from overwhelming shared resources.

How It Works

Limits are usually expressed as a number of requests per unit of time, scoped to a key such as an API token, user, or IP address. Common algorithms include the fixed window, sliding window, token bucket, and leaky bucket. Token bucket is popular because it allows short bursts while enforcing a steady average rate.

When a client exceeds its limit, the service typically responds with HTTP status 429 Too Many Requests and headers describing the remaining quota and a Retry-After hint. In distributed systems the counters live in a shared store such as Redis so that limits hold across many instances.

Why It Matters

Rate limiting protects availability. It absorbs traffic spikes, blunts denial-of-service attempts, contains buggy clients in retry loops, and ensures fair access across tenants. It also enforces commercial tiers, where different plans get different quotas.

The design must balance protection against usability. Limits that are too tight frustrate legitimate users, while limits that are too loose fail to protect the system. Clear error responses and well-designed client backoff, such as exponential backoff with jitter, make rate limits cooperative rather than disruptive.

Rate limiting is often paired with throttling, quotas, and circuit breakers as part of a broader resilience strategy, and is frequently enforced at the edge.

Related Terms

Rate limiting is commonly applied at an API gateway or reverse proxy and relates closely to throughput management in REST and other APIs.