08/20/2026
One client. One million requests. Your API just fell over.
APIs can’t tell the difference between a legit traffic spike and abuse — unless you set a limit. That’s rate limiting.
What it does: Caps how many requests a client can make in a given window (e.g., 100 requests/minute/user). Cross the limit → requests get rejected or delayed until reset.
Without it:
❌ One client hogs server resources
❌ Traffic spikes take down your infra
❌ Brute-force attacks get easier
❌ Everyone else pays for one bad actor
With it:
✅ Predictable performance under load
✅ Fair access for every client
✅ An extra layer of security by default
The main strategies:
■ Fixed Window — fixed quota per time block
■ Sliding Window — quota tracked over a moving timeframe
■ Token Bucket — requests spend tokens that refill over time
■ Leaky Bucket — requests processed at a steady, constant rate
In practice: Limit set at 100 req/min. A user sends 20 → ✅. A client sends 100 → ✅. Request #101 → 🛑 HTTP 429 Too Many Requests.
The takeaway: Rate limiting isn’t about blocking users — it’s about making sure one client can’t spend resources that belong to everyone else. A scalable API doesn’t just absorb traffic. It governs it. 🚦