{"head":{"title":"What Is Rate Limiting? Definition and Example | OceanLab","description":"Rate limiting caps how many requests a user, key or IP can make in a period, to protect a system and share it fairly. How it works and common mistakes.","canonical":"https://oceanlab.in/glossary/rate-limiting"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"rate limiting","path":"/glossary/rate-limiting"}],"slug":"rate-limiting","term":"Rate limiting","aka":["throttling","API rate limit"],"category":"System design","short":"Capping how many requests a user, API key or address can make in a given time, to protect a system and share capacity fairly.","body":[["A rate limiter counts requests per caller over a window, such as 100 per minute, and rejects or delays the rest. The standard HTTP response for this is 429 Too Many Requests, defined in RFC 6585, which may include a Retry-After header saying how long to wait."],["Common methods include fixed windows, sliding windows and token buckets, which allow short bursts while holding an average rate. Limits are often enforced at the ",{"href":"/glossary/api-gateway","text":"API gateway"},"."]],"why":["Without limits, one buggy script, a scraper or an attacker can slow the system for everyone or run up costs, especially when each request calls a paid API or an AI model. Limits also protect logins from password guessing and set clear rules for API customers."],"example":["An AI writing tool lets each free user send 20 requests an hour and paid users more. When a user's script loops, it hits the limit, gets 429 responses and the model bill stays flat. The login page has its own, stricter limit per account and per IP."],"inBuild":["We set limits per user, per tenant and per IP, store counters in a fast shared store so all servers agree, return 429 with Retry-After, and make our own clients back off politely when they hit a third-party API's limits. Limits are tuned from real traffic, not guessed once."],"mistakes":[["Limiting only by IP, which blocks whole offices behind one address and misses distributed abuse."],["Counters kept in each server's memory, so limits multiply with the number of servers."],["No limits on expensive endpoints, such as AI calls, exports and search."]],"related":[{"href":"/glossary/api-gateway","label":"API gateway","detail":"A single entry point that sits in front of a system's APIs and handles routing, auth and limits for every request."},{"href":"/glossary/idempotency","label":"Idempotency","detail":"The property of an operation that has the same effect whether it runs once or several times, so it is safe to retry."},{"href":"/glossary/message-queue","label":"Message queue","detail":"A buffer that holds messages, such as tasks or events, until a worker is ready to process them, so the sender does not have to wait."},{"href":"/glossary/edge-function","label":"Edge function","detail":"A small piece of server code that runs on a CDN's servers around the world, close to the user, instead of in one central region."},{"href":"/glossary/token","label":"Token (LLM)","detail":"The unit an AI language model reads and writes, and the unit most LLM APIs bill by."}],"tools":[{"href":"/tools/llm-api-cost-calculator","label":"LLM API cost calculator","detail":"Free tool"}],"links":[{"href":"/pricing/categories/llm-api","label":"LLM API pricing","detail":"Model prices side by side, with sources."}],"sources":[{"title":"RFC 6585, section 4: 429 Too Many Requests (IETF)","url":"https://www.rfc-editor.org/rfc/rfc6585#section-4","checkedAt":"2026-10-25"}],"legal":false,"updatedAt":"2026-10-25"}