Rate limiting, explained
Limits are usually enforced per API key, account or IP address, with algorithms such as token bucket or sliding window. Exceeding a limit typically returns 429 Too Many Requests, often with a Retry-After header.
Lowering a rate limit can be a breaking change in practice: clients that were within the old limit start failing without any change to their code.
Related terms
- API gateway: An API gateway is a server that sits in front of one or more APIs and handles cross-cutting concerns such as routing, authentication, rate limiting, logging and version routing.
- Breaking change: A breaking change is a change to an API that causes a correctly written client, which worked before, to fail or behave differently without modifying its code.
- Idempotency: An API operation is idempotent when performing it multiple times has the same effect as performing it once, which makes retries safe.