Software → System Design
Rate Limiting
A technique for controlling how many requests a client or system can make in a time window.
Where it fits
Rate limiting controls how often a client, user, or service can perform an operation. It appears in API design, security, reliability, and system design.
Mental model
Rate limiting is a protective boundary. It prevents accidental overload, abuse, brute force attacks, and noisy neighbors.
Example
An API may allow 100 requests per minute per user. Requests above the limit receive a 429 Too Many Requests response.
Common mistakes
- Applying one global limit to every user and endpoint.
- Forgetting burst behavior.
- Not communicating retry timing to clients.
Related concepts
API gateway, HTTP status code, reliability, backpressure.