Rate Limiting, Quotas & Abuse Protection · Rate Limiting Fundamentals
Why Rate Limit?
Protect availability, fairness, cost and security.
Rate limiting caps how much work a client can request in a period. It protects availability (one client can't exhaust capacity), fairness (noisy neighbors can't starve others), cost (expensive endpoints, LLM tokens, SMS), security (brute force, credential stuffing, scraping, enumeration) and business rules (plans and quotas). Related controls: quotas (long-period allowances, e.g. 100k calls/month), concurrency limits (in-flight requests), and load shedding (server-wide overload protection).
Related traffic controls
| Control | Limits | Time scale | Typical response |
|---|---|---|---|
| Rate limit | Requests per window | Seconds–minutes | 429 + Retry-After |
| Quota | Usage per billing period | Days–months | 429/403 + upgrade info |
| Concurrency limit | In-flight requests | Instantaneous | 429/503 |
| Load shedding | Total server load | Instantaneous | 503 + Retry-After |
| Cost limit | Weighted units (tokens, query cost) | Minutes–months | 429 |
Common pitfalls
- Rate limits as the only abuse defense.
- One global limit for every endpoint regardless of cost.
- No limits on internal APIs (a buggy job can still take you down).
Key points
- Availability, fairness, cost, security
- Rate limits ≠ quotas ≠ concurrency limits
- Limit by cost, not just count
Further reading: Google Cloud: Rate-limiting strategies
Practice questions
What's the difference between a rate limit and a quota?
Answer
A rate limit controls burst/throughput over short windows (e.g., 100 requests/minute); a quota caps total usage over a long period (e.g., 1M requests/month), often tied to billing plans.
Why might you need a concurrency limit in addition to a rate limit?
Answer
A few slow, long-running requests can consume all workers even at a low request rate; concurrency limits cap simultaneous in-flight work.
Open in the app to mark lessons complete, take notes and track your progress.