Rate limiting

Capping how many requests a client can make to an API in a given time window, to protect the server from overload and abuse.

Example: An API that returns 429 Too Many Requests after 100 calls per minute from a single token.

In practice: Clients hitting rate limits should back off with exponential jitter, not retry immediately — a thundering herd of clients all retrying at once after a 429 is how you take down a service in exactly the way the rate limit was meant to prevent.

• often paired with Pagination