What is rate limiting in an API?
Rate limiting controls how many requests a client can make in a given time window, such as 100 requests per minute. It protects the API from being overwhelmed, whether by accident or abuse, and keeps the service fair for everyone. When a client goes over the limit, the API responds with status code 429 Too Many Requests.
- Rate limiting caps how many requests a client can make in a time window.
- It protects an API from overload and abuse and ensures fair use.
- Exceeding the limit usually returns the 429 Too Many Requests status.
Why APIs need it
- Protects the server from overload and crashes.
- Stops one user from hogging all the capacity.
- Defends against abuse and simple denial of service attempts.
A common technique is a token bucket, where each client has a bucket of tokens that refills over time and each request uses one token. When the bucket is empty, requests are rejected until it refills.
Mention the 429 status code and the Retry After header. Saying the API returns 429 with a hint on when to try again shows you know how clients are expected to handle limits.
Frequently asked questions
What is a common rate limiting algorithm?
Token bucket and fixed or sliding window counters are common. Token bucket allows short bursts while keeping a steady average rate.
How do clients know their limit?
Servers often return headers showing the limit, remaining requests, and reset time, so clients can slow down before being blocked.
Common follow up questions
Related interview questions
Want the full API Design guide?
Read every API Design concept with notes, diagrams, and code in one place. Track your progress as you go.
Open the API Design guide All API Design questions