Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsAPI rate limiting controls how much traffic a requester can send within a defined policy. Done well, it protects finite backend capacity, allocates usage predictably, and tells clients what to do when they exceed a limit. The key design decisions are what to count, which callers share a quota, how to handle bursts, and whether excess work is rejected or queued.
What does API rate limiting do?
A rate limiter checks incoming requests against a policy and allows, delays, or rejects work when the policy is exceeded. A gateway can enforce that policy before requests reach upstream services, avoiding work the backend cannot safely handle.
As an Amazon Associate I earn from qualifying purchases.
A useful policy can be described as a tuple: what is counted, for whom, over what interval, with what burst allowance, and where it is enforced. For example, a service might count requests per API credential on a particular route, while also enforcing a broader ceiling for the whole backend. HTTP standards do not prescribe the identity or counting method; those are server policy choices. RFC 6585
Choose the limit key deliberately
Common keys include an authenticated user, API credential, tenant, IP address, route or resource, or the service as a whole. Per-consumer policies can support fairness between customers, while a global limit protects shared capacity; using both can address different risks.
#1 Best Overall
- API Design Patterns
- ABIS BOOK
- Manning Publications
An IP address is an imperfect identity: many people may share one address behind network translation, while a single client’s address can change. Where possible, authenticated identities provide a more meaningful basis for a customer-specific quota.
Which rate-limiting algorithm should you use?
No algorithm is universally best. Choose according to whether your system should allow bursts, smooth arrivals, or enforce a rolling quota, and account for the state and latency the implementation requires. Gateways can differ in how they store counters, queue work, and handle interval boundaries. Apache APISIX’s algorithm overview describes common approaches; a survey of distributed API rate limiting also notes gaps in comparative research. FRUCT survey
| Approach | How it behaves | Useful when | Main trade-off |
|---|---|---|---|
| Token bucket | Credits refill at a configured rate up to a capacity. Each request spends credit, so stored tokens permit a bounded burst while the refill rate constrains average use. | Occasional bursts are acceptable, but sustained use must be bounded. | The burst capacity needs tuning; even a bounded burst can overwhelm an upstream service. In managed services, configured rate and burst values may be targets rather than guaranteed ceilings. |
| Leaky bucket as a queue or shaper | Requests enter a finite queue and are emitted at a steadier rate. When the queue fills, new work must be rejected or handled another way. | The downstream service needs smoother arrivals and the work can tolerate delay. | Queueing adds latency and requires a queue size and an overload policy. Some descriptions use “leaky bucket” for a meter rather than a queue, so check which variant a product means. |
| Fixed-window counter | Counts requests in a set interval and resets at its boundary. | A simple quota such as a fixed number of requests per minute is sufficient. | Requests can cluster on both sides of a boundary: a caller may use much of one window just before reset and immediately use the next window’s allowance. |
| Sliding-window log or counter | Tracks a rolling interval using request timestamps, or estimates it from counts in neighboring windows. | Enforcing a rolling quota matters more than minimizing state cost. | Timestamp logs require more state and work; counter approximations reduce overhead at the cost of precision. |
What HTTP status code should I return for rate-limited requests?
Use 429 Too Many Requests when a requester has sent too many requests in a given amount of time. RFC 6585 defines the status but leaves identity and counting to the server: a limit might apply to one resource, the whole server, or multiple servers, and identity might come from credentials or a stateful cookie. The response should explain the condition and may include a Retry-After field. A 429 response must not be stored by a cache. RFC 6585, section 4
Rank #2
Retry-After is useful when the server can offer actionable wait guidance. Under RFC 9110, its value is either an HTTP date or a non-negative integer number of seconds; it is guidance from the server, not a field every implementation is required to send. RFC 9110
Do not assume every provider uses 429 for every kind of limit. GitHub documents that exhausting a primary REST API limit may produce 403 or 429; its response headers are the status signal, and the exact remaining-count value should not be treated as a dependable promise. Those are GitHub-specific behaviors, not general HTTP requirements. GitHub REST API rate limits
How do I handle rate limiting in a distributed gateway deployment?
With a single gateway instance, local counters can track requests there. With multiple instances, independent local counters may produce different effective limits depending on how traffic is distributed. A shared store or external global limiter can coordinate quota state, but adds latency and a dependency that must itself be operated.
Coordination is not automatically exact or strongly consistent: the result depends on the implementation’s state model, synchronization, and failure behavior. Redis-backed synchronization is one approach discussed in distributed API deployments, but comparative evidence does not establish a single universally superior mechanism. FRUCT survey
Recommended Free Tools
A gateway is often a practical shared enforcement point because it can reject requests before they consume upstream capacity and apply common policies across backend services. Decide explicitly what happens if the limiter’s shared state is unavailable: allowing requests can expose the backend to overload, while rejecting them can interrupt otherwise valid traffic.
Should I rate limit internal service-to-service traffic?
Internal traffic can still overwhelm a dependency, especially during retries, fan-out, or a partial outage. A limit can protect a shared service from a caller that sends too much work, but the policy should reflect service relationships and failure behavior rather than blindly applying an external-customer quota.
Consider limits where a service needs a predictable share of a constrained dependency, and pair them with an explicit overload response or queueing policy. Monitor which caller and route are being limited so that a protective control does not hide a capacity shortfall or an unexpected increase in legitimate internal demand.
How do I communicate rate limits to API consumers?
Document the quota’s scope and behavior: what is counted, which identity shares it, the interval, whether bursts are allowed, and what response signals exhaustion. In a 429 response, explain that the limit was reached and include Retry-After when a meaningful wait can be given.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallClients should honor that guidance and avoid immediate retry loops. GitHub’s guidance is a provider-specific example: for secondary limits, it says to follow Retry-After when present, otherwise wait at least one minute; repeated failures call for exponentially increasing delays and eventually stopping retries. GitHub also warns that continued attempts while limited may result in an integration ban. GitHub REST API rate limits
How do you set a limit the backend can actually sustain?
A configured number is not proof that a service can handle that rate in production. AWS recommends establishing service capacity through representative load testing, documenting the tested limits, and avoiding increases beyond what testing established. When processing can be asynchronous, queues or streams can smooth arrivals. AWS Well-Architected REL05-BP02
Amazon API Gateway illustrates why configuration and guarantees should be distinguished: it uses token-bucket throttling with rate and burst targets and may return 429 when submissions exceed them. AWS says throttles are applied on a best-effort basis and should be treated as targets, not guaranteed request ceilings. That is a product-specific caveat, but a useful reminder to validate any limiter against the actual backend. Amazon API Gateway HTTP API throttling
- Establish capacity: load test representative requests and dependencies rather than choosing a limit by intuition alone.
- Test steady rate and bursts: document test conditions and the supported envelope, including the burst behavior the system can sustain.
- Choose overload behavior: decide whether excess work is rejected immediately or queued, and set queue capacity and overflow handling if it is delayed.
- Make rejection actionable: return an explanatory 429 and
Retry-Afterwhere a meaningful wait is known. - Set client retry rules: honor server guidance, use bounded exponential backoff when appropriate, and stop after a defined retry budget.
- Monitor and revisit: track rejections by route and consumer to distinguish abuse, a limit set too low, and legitimate growth. Reassess after changes to payload size, latency, dependency capacity, or deployment topology.
Provider quotas are examples, not design targets
Provider-specific published quotas illustrate why a quota must always be read in context. GitHub’s current REST API documentation lists 5,000 requests per hour for its standard REST API limit, and 15,000 requests per hour for certain organization-owned GitHub Apps or OAuth apps on GitHub Enterprise Cloud. It separately documents Git LFS API buckets of 300 requests per minute unauthenticated and 3,000 requests per minute authenticated. These are GitHub policies, not general API best practices or backend capacity benchmarks; check GitHub’s current documentation for the applicable product and authentication context. GitHub REST API rate limits
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
