Simple definition
Rate limiting restricts how many requests or actions a client, identity, or resource can perform during a given period.
Technical definition
An API or gateway tracks a counter using a key such as an IP address, user, API key, or endpoint. Common algorithms include fixed window, sliding window, leaky bucket, and token bucket.
How it works / role
For each request, the mechanism checks the remaining quota. Requests are accepted while capacity is available; when the limit is exceeded, they can be delayed or rejected, commonly with HTTP 429 and information that helps the client retry later.
What is it used for?
Protect an API from abuse, smooth traffic peaks, enforce quotas, and prevent a single client from consuming disproportionate resources.
Practical example
An API allows 100 requests per minute for each API key. The 101st request receives HTTP 429 until quota becomes available again.
Common issues
- The threshold is too low and blocks legitimate usage
- The limiting key is incorrect behind a proxy or NAT
- The client does not implement backoff after HTTP 429
- Counters are not shared consistently across multiple application nodes
Key takeaway: Effective rate limiting defines who is counted, over which window, at what threshold, and how clients should recover after being limited.