API rate limiting is a control that caps how many requests a client can make to an API within a given time window, protecting the service from overload and abuse and keeping it responsive for everyone.
The server counts each client's requests over a time window and rejects further requests once the limit is reached, usually returning an error that tells the client to slow down and when it may try again. Limits are commonly tracked per API key, per user, or per IP address.
Rate limits stop a single client from overwhelming the service, contain the damage from buggy or abusive callers, and share capacity fairly among users. They also help control infrastructure cost by bounding the amount of traffic.
A well-behaved client watches for the rate-limit response, waits for the time the server indicates, and retries with increasing back-off. Spreading requests out over time and caching results reduces how often the limit is reached.
The API rejects further requests for a time, typically returning an error that says you are being rate limited and how long to wait before retrying.
By counting requests per client over a time window, for example per API key, per user, or per IP address, and blocking requests once the cap for that window is reached.
Home · By Runze