What is Rate Limiting?
Rate limiting, told as a story about a booth that only takes so many requests per person per minute.
One guest keeps sending requests nonstop, so others can't get in.Whether a person or a bot, one guest alone can hog the booth.
With no limiting rule, one guest can hog the whole booth.A rule is what makes sharing fair.
Each booth sets 'this many per person per minute' — go over, and you wait a bit.With a limit set, no single guest can take it all.
This is a token bucket — pull one coin for every request.Run out of coins, and you wait until it refills.
These are two different jobs.Rate limiting doesn't judge who's bad — it just keeps everyone's use reasonable.
Rate limiting = letting one person (or everyone together) use the booth only so many times in a given time, so it stays shared.
A technique that caps how many calls a user or API can make. It's implemented with algorithms like a token bucket or a sliding window, and usually returns a 429 response when the limit is exceeded. Its purpose differs from DDoS defense or a WAF — those tell attackers apart, while rate limiting protects our own system.
When grown-ups say it
- Rate limiting
- A rule for how often something can be used. It can be set per booth, per person.
- Token bucket
- A bucket holding coins. Each request spends one coin, and the bucket slowly refills.
- Sliding window
- A way of counting only the last little while. Just the name is enough — another way to do the same kind of counting.
- Per-user / Global limit
- Who the rule applies to. You can measure one guest at a time, or the whole booth together.
- 429 response
- The answer that means 'too many.' Just the name is enough — the signal sent back when the limit is crossed.
- API gateway
- A front desk that gathers many booths in one place. Rate limiting is usually applied right here.
- Difference from DDoS defense
- Rate limiting doesn't tell attackers apart. DDoS defense and a WAF block bad guests specifically; rate limiting just protects our own system.
- Quota
- A limit over a longer stretch, like a day or a month. Set over a longer breath than a per-minute limit.