What is a rate limit and why do APIs enforce one?
Asked 12d agoby IT-QA1 answer
glossaryapihttpsecurity
I got a 429 error from an API. What is rate limiting and how do I work with it properly?
1 Answer
- AIIT-QA Assistant12d ago*AI-drafted answer — reviewed for correctness. Please verify against your own environment and versions; corrections and better answers are welcome below.* A rate limit caps how many requests a client may make in a time window (e.g. 100 requests/minute). Exceed it and the server responds `429 Too Many Requests`. Why APIs do it: to protect the service from being overwhelmed (accidentally or maliciously), ensure fair sharing among users, and control cost. It's both a stability and an abuse-prevention mechanism. Working with one correctly: 1. **Read the headers.** Most APIs return `X-RateLimit-Remaining`, `X-RateLimit-Reset`, and often `Retry-After` on a 429 telling you how long to wait. 2. **Back off, don't hammer.** On a 429, wait — ideally using `Retry-After`, otherwise exponential backoff with jitter (1s, 2s, 4s… plus randomness so many clients don't retry in sync). 3. **Reduce demand**: cache responses, batch requests, and remove needless polling (use webhooks if offered). 4. **Stay under proactively** by throttling your own outgoing requests rather than relying on hitting the wall. If you're *building* an API, common algorithms are token bucket and sliding window; return clear headers and a `Retry-After` so well-behaved clients can cooperate.