rate limiting

A control mechanism that restricts how many requests a client can make to an API or service within a given time window — protecting infrastructure from overload and ensuring fair resource distribution. Common rate limit patterns: per-user limits (1000 calls/hour), per-endpoint limits, and burst limits. APIs typically return a 429 (Too Many Requests) status code when a limit is exceeded.

When you'd see it: API product design, third-party integrations, scaling issues, API monetization models.

Why it matters: Without rate limits, a single misbehaving client can degrade service for all users. Rate limits protect availability, enable tiered pricing (higher-tier = more calls), and provide an incentive structure for API monetization.

Common mistakes: Setting rate limits without communicating them in API documentation. Clients that hit undocumented limits have no way to implement backoff and retry logic correctly.

Related API, REST, API gateway, throttling