---
title: "Rate limiting"
description: "Rate limiting caps how many requests a client can send per time window, protecting servers and APIs from overload and abuse. Learn the core algorithms."
url: "https://nodea.io/en/glossary/rate-limiting"
lang: "en"
updated: "2026-07-13"
---

# Rate limiting

> Rate limiting is a technique for controlling how many requests a client can send to a server or API within a set time window, protecting resources from overload and abuse.

**Rate limiting** is a technique for controlling how many requests a single client — an IP address, a user or an API key — can send to a server within a defined time window. Once the threshold is crossed, further requests are rejected (usually with [HTTP](https://nodea.io/en/glossary/http) status 429 Too Many Requests) or delayed. The mechanism protects infrastructure from overload, abuse and certain kinds of attack.

## How rate limiting works

A limit is defined as a number of requests per unit of time, e.g. "100 requests per minute per IP". Several classic algorithms enforce it:

- **Token bucket** — tokens drip into a "bucket" at a fixed rate; each request consumes one, and when the bucket is empty the request is rejected. This allows short bursts of traffic.
- **Leaky bucket** — requests drain out at a constant rate, smoothing traffic.
- **Fixed window / sliding window** — counting requests within a fixed or sliding time boundary.

Rate limiting can be applied at several levels: in the application layer (e.g. framework [middleware](https://nodea.io/en/glossary/middleware)), on a proxy or web server (Nginx), in an API gateway, or in an application [firewall](https://nodea.io/en/glossary/firewall).

## Rate limiting in practice

Request-rate limiting is a standard way to protect network services:

1. **API protection** — an [API](https://nodea.io/en/glossary/api) imposes per-key limits to ensure fair access and guard against resource abuse.
2. **Attack defense** — limits hinder [brute force](https://nodea.io/en/glossary/brute-force-attack) against login forms and blunt some [DDoS](https://nodea.io/en/glossary/ddos) attacks.
3. **Server stability** — capping requests per endpoint prevents aggressive bots and scrapers from exhausting resources.

Well-designed rate limiting distinguishes authenticated traffic from anonymous and returns clear headers with the remaining quota, so clients can adjust how often they call.

### How does rate limiting differ from throttling?

The terms are sometimes used interchangeably, but rate limiting usually means hard-rejecting requests above a limit (a 429 response), while throttling means slowing or queuing excess requests without rejecting them. Both protect resources from overload.

### What HTTP status does the server return when the limit is exceeded?

The standard is 429 Too Many Requests. The response often includes a Retry-After header telling the client how long to wait before retrying, plus headers describing the remaining quota.

## Related

- [API](https://nodea.io/en/glossary/api)
- [DDoS](https://nodea.io/en/glossary/ddos)
- [Brute force](https://nodea.io/en/glossary/brute-force-attack)
- [Firewall](https://nodea.io/en/glossary/firewall)
- [Middleware](https://nodea.io/en/glossary/middleware)

---

Languages: [pl](https://nodea.pl/pl/slownik-pojec/rate-limiting.md)  
Site index: [llms.txt](https://nodea.io/en/llms.txt)