Introduction

In modern web development, APIs (Application Programming Interfaces) are used everywhere—from mobile apps to web applications and cloud services. As the number of users increases, APIs can receive thousands or even millions of requests.

If not controlled properly, too many requests can overload the server, slow down performance, or even crash the system. This is where rate limiting comes into play.

Rate limiting is a technique used to control how many requests a user or system can make to an API within a specific time period.

In this article, we will explain rate limiting in simple terms, explore visual diagrams of core algorithms, look at API Gateway implementations (Azure and AWS), and build a Redis-based distributed solution step by step.

What is Rate Limiting in APIs?

Rate limiting is a method used to restrict the number of API requests a client can make in a given time.

Simple Definition

"You can make only a certain number of requests in a specific time frame."

Example

If the limit is exceeded, the API returns HTTP 429 (Too Many Requests).

Why is Rate Limiting Important?

How Rate Limiting Works

Step-by-Step Flow

  1. Client sends API request

  2. Server identifies the client (IP/API key/User ID)

  3. Server checks request count in the current window

  4. If within limit → process request

  5. If exceeded → reject with 429 response

Visual Diagram: Token Bucket Algorithm

Flow Representation

[Bucket Capacity: 10 Tokens]
↓
[Tokens added every second]
↓
[Each request consumes 1 token]
↓
[If tokens available → allow request]
[If empty → reject request]

Simple Explanation

Why Use Token Bucket?

Visual Diagram: Sliding Window Algorithm

Flow Representation

Time Window → [Last 60 seconds]

Requests:
|----|----|----|----|----|

Count requests in last 60 seconds → Compare with limit

Explanation

Types of Rate Limiting (Quick Recap)

Implementing Rate Limiting Step by Step

Step 1: Choose Algorithm

Step 2: Identify Client

Step 3: Store Request Data

Step 4: Validate Request

Step 5: Return Response

{
  "error": "Too many requests",
  "status": 429
}

API Gateway Rate Limiting (Azure & AWS)

Azure API Management Example

Azure API Management allows built-in rate limiting using policies.

Example Policy

<rate-limit calls="100" renewal-period="60" />

Explanation

Benefits

AWS API Gateway Example

AWS API Gateway supports throttling.

Example Settings

Explanation

Benefits

Redis-Based Distributed Rate Limiting

In real-world microservices, multiple servers handle requests. We need a shared storage system like Redis.

Why Use Redis?

Step-by-Step Implementation (Node.js + Redis)

Step 1: Install Packages

npm install ioredis

Step 2: Connect Redis

const Redis = require('ioredis');
const redis = new Redis();

Step 3: Implement Rate Limiter

async function rateLimiter(key, limit, window) {
  const current = await redis.incr(key);

  if (current === 1) {
    await redis.expire(key, window);
  }

  if (current > limit) {
    return false;
  }

  return true;
}

Step 4: Use in API

app.use(async (req, res, next) => {
  const allowed = await rateLimiter(req.ip, 100, 60);

  if (!allowed) {
    return res.status(429).send("Too many requests");
  }

  next();
});

How It Works

Real-World Use Cases

Login API

Public APIs

Payment APIs

Best Practices for Rate Limiting

Common Mistakes to Avoid

Key Takeaways

Summary

Rate limiting is a critical technique for building secure, scalable, and high-performance APIs. By using algorithms like token bucket and sliding window, implementing controls at API gateway level, and using Redis for distributed environments, developers can effectively manage traffic, prevent abuse, and ensure smooth user experience. Proper rate limiting not only improves performance but also strengthens API security in modern cloud-based applications.