This post was originally published in Portuguese on my blog: Rate limiting em Minimal APIs com o middleware nativo do .NET .

Every API exposed to the internet will, sooner or later, get a client that decides to hit the same endpoint a thousand times per second. It might be a bug in a retry loop, a poorly written script or someone trying their luck. If you have no limit at all, the database, the CPU and your other users pay the bill.

The good news is that since .NET 7, rate limiting ships with the framework. No extra package, no third-party library. In this post I build a small example with Minimal APIs, per-IP limits, a 429 response with Retry-After and integration tests.

The core idea

The middleware works with two concepts: the limiter (the algorithm: fixed window, sliding window, token bucket or concurrency) and the partition (who is being limited). Without a partition, the limit is global, and one abusive client takes the service down for everyone.…