Rate limiting.
also: rate limiter · rate limiters · rate limit · rate limits · rate-limitedCapping how many requests a client may make per time window, and rejecting or delaying the excess.
the two-minute refresher
- A contract: up to N requests per period T per key (API key, IP, user); beyond that, rejected until the period resets.
- It protects you from abuse, runaway clients and cost blow-ups.
- It lives at several layers: CDN/edge, API gateway, application.
- Tell clients their state: 429 Too Many Requests plus limit/remaining/reset headers.