What is API rate limiting?
API rate limiting controls how many requests a client may make over a defined interval.
How it works and where it is used
Fixed windows, sliding windows and token buckets implement different policies. Limits can use user, key or trusted network identity. IP-only rules can affect innocent users behind shared networks; client-supplied identity can be spoofed. A 429 response and retry guidance help clients back off.
Limits, safety and selection criteria
Distributed counters, bursts and fairness require design. Rate limiting alone is not DDoS protection; caching, queues, authentication and network controls may be needed. Monitor success and false-block rates. API rate limiting controls how many requests are accepted in a period. A login endpoint can use both account and IP limits to slow password guessing, while avoiding undue harm to people on shared networks. A token bucket allows reasonable bursts but caps sustained traffic. A 429 response with retry guidance helps clients back off. Distributed counters, distinct identities and endpoints with different costs need careful design. Monitor real user errors and abuse patterns rather than optimizing a single request count.