Skip to content
  • Rate limiting · API Design

Rate limiting

LearnViaNotes @learnvianotes· 1 min read

Rate limiting protects your API from abuse, DDoS, and accidental over-use. Every production API must have it.

HTTP/1.1 429 Too Many Requests
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 0
Retry-After: 60

{ "error": { "code": "RATE_LIMIT_EXCEEDED", "message": "Retry in 60s" } }

Algorithms

Token bucket

Leaky bucket

Sliding window

Fixed window

Strategies

Free for students and teachers

Write notes like this one

Cards for every idea, quizzes and flashcards, read aloud — on the web and your phone.

Something wrong with this note? Open it to report