glossary2 min read

Rate Limiting Explained

Rate limiting protects APIs from abuse by capping requests per user.

Rate limiting restricts how many requests a client can make to an API within a time window. Common patterns: fixed window (100 requests per minute), sliding window (smoother distribution), token bucket (burst-friendly). Implement with Redis counters or middleware like express-rate-limit. Return HTTP 429 (Too Many Requests) when limits are exceeded.