Rate Limiting

Opening Scenario

You launch a public API. Within a week, one integration partner's buggy script starts looping, hitting your /search endpoint 50,000 times per minute. Your database is at 100% CPU. Legitimate users get timeouts. You have no way to stop the bad client without blocking all traffic. You needed to set limits before traffic arrived.

---

Question Progression

1. What does rate limiting actually limit?

Question: "Rate limiting" sounds like slowing down responses. But you're not making responses slower — you're refusing some requests entirely. What exactly are you measuring and enforcing?

Reasoning: A rate limit is a policy expressed as N requests per time window per identity. "Identity" can be an IP address, an API key, a user ID, or a combination. "Time window" can be per second, per minute, per hour. When a client exceeds the limit, you reject their request — typically with a 429 Too Many Requests…