Rate Limiting

Problem

One client sends: 100,000 requests/sec Your API can handle only 20,000. One consumer shouldn't be able to exhaust capacity for everybody.

Solution — Rate Limiting

Limit how much traffic a client may generate. An API gateway commonly enforces rate limits before requests reach the backend. Reverse proxies, WAFs, applications, and some load balancers can also enforce them. Rules can count requests per IP, user, or API key and typically return HTTP 429 Too Many Requests when exceeded.

Client A → 100 req/sec ✓
Client A → request 101 ✗

Core idea: rate limiting protects shared capacity by controlling request frequency.