Rate limiting protects APIs from accidental overload, brute-force attacks, scraping, credential attacks, and abusive clients.

Common algorithms include fixed window, sliding window, token bucket, and leaky bucket.

Limits may be applied per IP, user, API key, organization, endpoint, or a combination. Distributed deployments generally need a shared rate-limit store such as Redis rather than process-local counters.

A rate-limited request commonly receives 429 Too Many Requests, optionally with Retry-After.