APIs · Lesson 9

Rate Limiting and Throttling

Protecting an API from Excess Traffic

Rate limiting caps how many requests a client can make in a time window. Throttling slows or rejects requests when capacity is constrained. These controls protect shared resources and make service behavior fairer under spikes or abuse.

A Simple Token Decision

A limiter can make a decision from a request count and a configured limit. Production systems usually store counters in a shared, atomic service so multiple application instances enforce one policy.

public class RequestLimiter {
    private final int maximumRequests;
    private int requestCount;

    public RequestLimiter(int maximumRequests) {
        this.maximumRequests = maximumRequests;
    }

    public boolean allowRequest() {
        if (requestCount >= maximumRequests) return false;
        requestCount++;
        return true;
    }

    public static void main(String[] arguments) {
        RequestLimiter limiter = new RequestLimiter(2);
        System.out.println(limiter.allowRequest());
        System.out.println(limiter.allowRequest());
        System.out.println(limiter.allowRequest());
    }
}

Limiting Strategies

Common Mistake and Practices

Common Mistake: Limiting only by IP address. Shared networks can contain many legitimate users, while attackers can rotate addresses; use identity, endpoint cost, and trusted infrastructure signals too.

• Return 429 Too Many Requests.
• Include a retry hint when known.
• Make limits visible to clients.
• Use shared storage in a multi-instance deployment.
• Apply stricter policies to expensive operations.

Real-World Use Case

The quiz-generation endpoint limits each learner to a small number of requests per minute, while lesson reads have a higher limit. This protects the AI-backed operation without making normal browsing frustrating.