A public API can receive requests from anyone.

That creates an obvious problem:

What stops one client from sending millions of requests?

Rate limiting.

Basic Idea

Suppose an endpoint allows:

100 requests per minute

Enter fullscreen mode

Exit fullscreen mode

A client that exceeds that limit might receive:

429 Too Many Requests

Enter fullscreen mode

Exit fullscreen mode

Why Rate Limit?

Rate limiting can help protect against:

Accidental request floods

Resource exhaustion

Credential abuse

Automated scraping

Some denial-of-service scenarios

Brute-force attempts It isn't a complete security solution, but it is an important layer.

Example

A simple policy could be:

GET /api/products 100 requests/minute

Enter fullscreen mode

Exit fullscreen mode

while a sensitive endpoint might use:

POST /api/login 10 requests/minute

Enter fullscreen mode

Exit fullscreen mode

Different endpoints often deserve different limits.

Where Should Limits Be Applied?

Possible strategies include limiting by:

IP…