You can rate-limit an API in code or configure a managed policy, but the choice affects where requests are counted, how bursts are handled, and whether a configured limit is a hard ceiling. For a small service, middleware may be enough; for centrally managed limits across routes or callers, an API gateway can make policy easier to administer. Neither approach works well until you decide what to count and who the limit applies to.
What API rate limiting does
Rate limiting controls how many requests a caller or resource can make over a period. A server might count requests by account, API key, IP address, route, or another identifier. The HTTP standard does not prescribe which identity or counting method to use: that choice belongs to the server. RFC 6585, section 4, defines the response used when a client sends too many requests, not a universal policy for deciding who is limited.
As an Amazon Associate I earn from qualifying purchases.
A common implementation is a token bucket. The bucket refills at a configured rate, and each request consumes a token. Its capacity determines how large a burst can pass before requests are delayed or rejected. A steady refill rate and a burst capacity are therefore separate settings, not two ways to express the same limit. AWS describes this model in its HTTP API throttling documentation and REST API throttling documentation.
What happens when a client exceeds a limit
HTTP status code 429 means the client has made too many requests in a given amount of time. RFC 6585 says the response should explain the condition and may include a Retry-After header telling the client when it can try again. Clients should honor that guidance rather than retrying immediately, which can prolong overload. The RFC also says that 429 responses must not be stored by caches. RFC 6585, section 4
#1 Best Overall
- The latest SonicWall TZ470W series, are the first desktop form factor nextgeneration firewalls (NGFW) with 10 or 5 Gigabit Ethernet interfaces. The series consist of a wide range of products to suit a variety of use cases.
- Reduce complexity and get the business running without relying on IT personnel with easy onboarding using SonicExpress App and Zero-Touch Deployment, and easy management through a single pane of glass.
- Drive business growth by investing in next-gen appliances with multi-gigabit and advanced security features, to future-proof against the changing network and security landscape.
- SonicWall 24x7 support provides chat, email, web, and telephone support for technical assistance | Dynamic Support is designed for customers who need continued protection through ongoing firmware updates and advanced technical support
- Hardware: Operating system: SonicOS 7.0 | Interfaces: 8x1GbE, 2x10GbE, 2 USB 3.0, 1 Console | Management: Network Security Manager, CLI, SSH, Web UI, GMS, REST APIs | VLAN interfaces: 128 | Access points supported (maximum): 32
Rate limiting and retry behavior need to be designed together: a server that returns 429 without useful timing information leaves clients to guess when to retry. Where your gateway or middleware supports it, return a clear error representation and suitable retry metadata.
Choose between custom code and a managed policy
| Consideration | Custom middleware or library | Managed gateway policy |
|---|---|---|
| Where limits are configured | In the application or service code; the scope depends on your implementation. | At provider-specific scopes such as an API, stage, method, route, or caller key. Exact options depend on the product. |
| Request counting | You choose the identity and counter behavior, but must implement and maintain them. | The service supplies documented policy controls, such as AWS API Gateway’s throttles or Azure API Management’s key-based policy. |
| Behavior across instances | An in-process counter can differ across service instances unless you provide shared coordination. | Central gateway policy avoids putting each limit solely in an application’s local counter; confirm the provider’s documented scope and guarantees. |
| Operational trade-off | More control over application-specific behavior, with the burden of implementation and operations. | Centralized configuration, with provider-specific semantics and possible best-effort rather than hard limits. |
This is a design comparison, not a neutral performance benchmark. AWS guidance supports token-bucket libraries where API Gateway is not used, but does not endorse or evaluate specific libraries. AWS Well-Architected Framework, REL05-BP02
When hand-built throttling makes sense
For a small, single-service application, middleware or a language library may be a practical choice, especially when the policy needs application-specific logic. Be cautious with an in-memory counter: if requests are distributed across multiple instances, each process may see only part of the traffic and enforce its own separate count. A shared counter or a gateway-level policy may be more appropriate when the limit must apply consistently across instances.
When a managed policy makes sense
A managed API gateway is worth considering when teams need to configure limits centrally across APIs, routes, methods, or caller identities. AWS API Gateway and Azure API Management both document such controls, but their fields, scope rules, and enforcement behavior are product-specific. Do not assume a setting in one service maps directly to a similarly named setting in another.
How gateway scope changes the policy
“Limit requests per second” is incomplete unless you specify whose requests are counted and where. AWS API Gateway’s REST API documentation describes regional, account, API or stage, method, and per-client usage-plan scopes. Its documented precedence is per-client or per-method usage-plan limit, then per-method stage limit, then account limit, then regional throttle. AWS REST API throttling documentation
AWS HTTP APIs also support route-level throttling. These options are AWS-specific examples, not a universal list of gateway scopes. AWS HTTP API throttling documentation
Azure API Management documents a rate-limit-by-key policy with a counter key, letting a policy count calls associated with a chosen key. Its example uses the caller’s IP address; that is an example, not a recommended default for every API. Azure API Management rate-limit-by-key policy reference
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What a “form field” configuration looks like
A managed policy can reduce rate limiting to a few explicit inputs, but those inputs still encode design decisions. In Azure API Management’s rate-limit-by-key policy, the documented settings include:
Rank #3
- The latest SonicWall TZ370 series, are the first desktop form factor nextgeneration firewalls (NGFW) with 10 or 5 Gigabit Ethernet interfaces. The series consist of a wide range of products to suit a variety of use cases.
- Reduce complexity and get the business running without relying on IT personnel with easy onboarding using SonicExpress App and Zero-Touch Deployment, and easy management through a single pane of glass
- Drive business growth by investing in next-gen appliances with multi-gigabit and advanced security features, to future-proof against the changing network and security landscape
- SonicWall Advanced Gateway Security Suite keeps your network safe from zero-day attacks, viruses, intrusions, botnets, spyware, Trojans, worms and other malicious attacks. Examine suspicious files at the gateway in a cloud-based multi-layered sandbox for inspection to keep your network safe from unknown threats. As soon as new threats are identified and often before software vendors can patch their software, SonicWall firewalls and Cloud AV database are automatically updated with signatures.
- Hardware: Operating system: SonicOS 7.0 | Interfaces: 8x1GbE, 2 USB 3.0, 1 Console | Management: Network Security Manager, CLI, SSH, Web UI, GMS, REST APIs | VLAN Interfaces: 128 | Access points supported (maximum): 16
calls: the number of calls allowed in the period.renewal-period: the period, in seconds, after which the counter renews. The Azure reference dated November 14, 2025, documents a maximum of 300 seconds for this policy.counter-key: the value used to distinguish counters, such as a caller-specific key.- Optional increment conditions and counts, and optional retry-after and remaining-call metadata.
The Azure reference’s example sets 10 calls per 60 seconds for a key based on caller IP. That illustrates the fields; it is not a universal safe limit or recommendation. The renewal-period maximum applies to this Azure policy, not to rate limiting in general. Azure API Management rate-limit-by-key policy reference
A comparable AWS setup uses different concepts and controls. AWS API Gateway describes a token-bucket rate and burst capacity, with configuration available at documented API scopes. For HTTP APIs, AWS provides route-level throttle configuration and a CLI example; for REST APIs, it documents scope precedence and usage-plan controls. Use the documentation for the specific API type rather than copying Azure field names or assuming the products enforce limits identically. AWS HTTP API throttling documentation · AWS REST API throttling documentation
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why a configured number may not be a hard cap
AWS explicitly describes API Gateway throttling values as best-effort targets: traffic can exceed them in some cases. A configured rate or burst value should not be described as a guaranteed maximum unless the provider documents that guarantee for the specific feature. AWS HTTP API throttling documentation
Free tools Windows power users keep installed
One-click scans. No signup required.
Before raising a limit, load-test the proposed setting and document the value that was tested, the API scope, and the observed behavior. AWS reliability guidance recommends testing and documenting intended limits before increasing them. When the underlying service cannot safely absorb sudden demand, buffering with a queue or stream such as SQS or Kinesis may help smooth traffic; AWS also identifies WAF rate rules as an option for specific consumers. AWS Well-Architected Framework, REL05-BP02
Quick Recap
A practical way to decide and configure
- Define the protected resource. Decide whether the limit protects the whole account, an API, a route or method, a tenant, or an individual caller.
- Choose the identity to count. Use an identity that matches the policy. An IP-based counter, for example, groups requests by network address rather than necessarily by customer or account.
- Set steady rate and burst behavior. For token-bucket systems, choose both the refill rate and bucket capacity. A burst allowance permits short spikes; it does not mean the system can sustain that rate indefinitely.
- Choose implementation scope. Use middleware or a maintained library when application-level control is useful and counter consistency is handled. Use a gateway policy when centralized controls at supported scopes fit the need.
- Specify the over-limit response. Return 429 with a clear explanation and, where supported, retry timing metadata. Ensure clients do not immediately retry in a tight loop.
- Test the actual configuration. Load-test the target on the relevant API scope and record the tested settings and results. Treat AWS throttle values as targets, not guaranteed ceilings.
- Plan for excess traffic. If the service needs protection beyond rejecting requests, consider buffering work or applying a separate control such as a WAF rate rule where appropriate.
What to compare before choosing
- Scope: Can the limit apply globally, per route or method, or per caller key as required?
- Burst handling: Is there a distinct burst capacity, and what happens when it is exhausted?
- Counter sharing: Will all service instances see the same count, or does the implementation require shared state?
- Client guidance: Does an over-limit response include 429 and useful retry metadata?
- Visibility: Can operators see throttling and adjust policy based on observed traffic?
- Enforcement strength: Is the value a best-effort target or a documented enforced ceiling?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
