Rate Limiting
Limits protect availability and fairness. Choose key (IP, user, API key, tenant), algorithm, and client-visible headers carefully.
Workflow
- Threat: abuse, noisy neighbor, cost control, fair multi-tenant.
- Dimension: per identity, per route, global.
- Algorithm: fixed window, sliding, token bucket — trade accuracy vs cost.
- Response: 429, Retry-After, rate limit headers.
- Bypass/admin paths and authenticated vs anonymous.
- Observability: reject rate, top offenders.
- Edge vs app vs gateway placement.
Output format
## Rate limit design
**Goals:** …
**Keys:** …
**Limits:** …
**Algorithm:** …
**Client contract:** …
**Fail mode:** open vs closed
Rules
- State fail-open vs fail-closed when the limiter store is down.
- Do not rate-limit health checks into outages.
- Document limits in API docs.
- Prefer tenant-aware limits in B2B.
- Avoid only IP limits behind shared NAT without care.
Edge cases
- GraphQL: cost-based limits.
- Webhooks outbound: separate egress budgets.
- Login endpoints: stricter anti-bruteforce.