Rate Limiting
Bound resource use and abuse across meaningful identities.
Problem
One caller or attack can monopolize finite capacity.
When to use it
- Public APIs, login, messaging, expensive commands
- Fairness and abuse controls matter
When not to use it
- As the only authorization or cost control
- A single global limit penalizes all tenants
Minimal example
Token bucket by API key plus IP/risk dimension; return 429 with retry guidance.
Tradeoffs
- Distributed counters may be approximate
- Limits need per-route cost and trusted identity