ratelimit

Rate limiting, sometimes written as ratelimit, is the practice of controlling how many requests a client may make to a service within a given time period. It protects resources, maintains performance, and prevents abuse by capping traffic and sharing capacity fairly among users.

Common approaches include token bucket, leaky bucket, fixed window, and sliding window algorithms. Token bucket permits bursts up to a capacity while tokens accumulate at a fixed rate. Leaky bucket releases requests at a steady rate. Fixed window counts requests in discrete intervals; sliding window smooths quotas over time.

Enforcement typically occurs at a service boundary such as API gateways, proxies, or load balancers, or inside individual services. Distributed rate limiting coordinates limits across nodes, often using a shared store (for example Redis) to track counts by client or API key.

Common signals include HTTP 429 responses and headers like RateLimit-Limit, RateLimit-Remaining, and RateLimit-Reset (or X-RateLimit-*). Clients should honor Retry-After and apply backoff to ease congestion during traffic spikes.

Limits may apply per client identity, IP address, endpoint, or combination. Dynamic limits adapt to traffic or plan level; static limits provide predictability. Challenges include clock drift, burstiness, cross-node consistency, and fairness.

Rate limiting is used in public APIs, web services, authentication workflows, messaging systems, and streaming platforms. Implementations range from centralized gateways to distributed enforcers, using in-memory caches for speed or persistent stores for coordination.