Sign in Get started

Free course · 20 lessons · Intermediate

Rate Limiting, Quotas & Abuse Protection

Protect APIs with the right algorithms (windows, token bucket, GCRA), distributed limiters, RateLimit headers, quotas and plans, concurrency and cost-based limits, fairness, and defenses against credential stuffing, bots and abuse.

Start the course

1. Rate Limiting Fundamentals

Why limit, which algorithm to use, and what to limit by.

  1. Why Rate Limit? — Protect availability, fairness, cost and security.
  2. Fixed Window, Sliding Log and Sliding Window Counter — Counting algorithms and their accuracy/cost trade-offs.
  3. Token Bucket and Leaky Bucket — Allow bursts while enforcing an average rate, or smooth output.
  4. GCRA: The Generic Cell Rate Algorithm — A memory-efficient, precise limiter used by many modern implementations.
  5. What to Limit By: Keys and Dimensions — Per IP, user, API key, tenant, endpoint and cost.

2. Distributed Implementation

Redis limiters, local vs global limits, headers, quotas and concurrency limits.

  1. Distributed Limiters with Redis and Lua — Atomic, shared limits across many app instances.
  2. Local, Global and Hybrid Limits — Trade accuracy for latency at very high request rates.
  3. Communicating Limits: Headers and 429 Responses — Tell clients their limits and when to retry.
  4. Quotas, Plans and Usage Limits — Long-period allowances tied to pricing tiers.
  5. Concurrency Limits and Adaptive Limiting — Cap in-flight work and adapt limits to observed latency.

3. Where and What to Enforce

Edge vs app limits, cost-based limits and fairness in multi-tenant systems.

  1. Limits at the Edge and Gateway — CDN/WAF and API gateway rate limiting.
  2. Application-Level Limits — Business-aware limits implemented in your services.
  3. Cost-Based Limits: GraphQL, Search and LLM Tokens — Limit by the work a request causes, not the number of requests.
  4. Fairness and Noisy Neighbors — Keep one tenant from degrading everyone else.

4. Abuse Protection and Operations

Credential stuffing, bots, abuse signals and operating limits safely.

  1. Defending Login and Account Endpoints — Credential stuffing, brute force, OTP abuse and account enumeration.
  2. Bots, Scraping and Automated Abuse — Distinguish good bots, bad bots and humans.
  3. Abuse Signals and Detection — Detect abuse patterns rate limits can't catch.
  4. Testing and Operating Rate Limits — Roll out limits safely and keep them healthy.

5. Capstone

Design rate limits for a public API and stop a login attack.

  1. Capstone: Rate Limits for a Public API — Design the complete rate-limiting and quota scheme for a developer API.
  2. Capstone: Stop a Credential-Stuffing Attack — Respond to an active attack and harden login permanently.