Back to All Blogs1 min read31 Aug 2026
System Design Foundations · Part 7 of 8
Rate Limiting APIs Without Breaking Good Users
“Understand token buckets, fixed windows and practical API protection.”
Rate Limiting APIs
Rate limiting controls how much traffic a caller may send during a period.
It can protect systems from accidental loops, abuse, credential attacks and expensive endpoints.
Fixed Window
user:42:2026-09-17T13:50
requests = 73Token Bucket
Generating diagram...
Choose the Correct Key
Possible identities include:
- user ID,
- organization ID,
- API key,
- IP address,
- endpoint + user.
HTTP Response
HTTP/1.1 429 Too Many Requests
Retry-After: 30Warning
Rate limiting is not authorization.
Rate limits should be based on expected usage and endpoint cost.
Finished this article?
Mark it done to update your series progress.