API Rate Limiting: Beginner to Expert Strategies

Rate limiting caps how many requests a client can make. It protects your API from abuse and keeps usage fair. This guide covers concepts to production patterns.

Beginner: Why Rate Limit?

Intermediate: Common Algorithms

Fixed window: Allow N requests per time window (e.g. 100/minute). Simple; can create bursts at window boundaries.

Sliding window: Count requests in the last N seconds. Smoother; slightly more work (store timestamps or use Redis).

Token bucket: Refill tokens at a rate; each request consumes one. Good for bursty but sustained limits.

1// Simple in-memory fixed window (example only)
2const limits = new Map();
3function rateLimit(key, limit = 100, windowMs = 60000) {
4  const now = Date.now();
5  const record = limits.get(key) || { count: 0, resetAt: now + windowMs };
6  if (now > record.resetAt) {
7    record.count = 0;
8    record.resetAt = now + windowMs;
9  }
10  record.count++;
11  limits.set(key, record);
12  return record.count <= limit;
13}

Advanced: Headers and Standards

Return standard headers so clients know their status:

Use 429 Too Many Requests when the limit is exceeded.

Expert: Distributed Rate Limiting and Policies

Combine with authentication and quota (e.g. daily caps) for a full policy. For encoding/decoding tokens or payloads, try our [Base64 Encoder](/tools/base64-encoder/) or [JWT Decoder](/tools/jwt-decoder/).