A Practical Guide to API Rate Limiting

By Owen Gallagher · August 3, 2026 · Engineering

Most engineering teams acknowledge the necessity of rate limiting while neglecting its underlying architecture. Relying purely on client IP addresses collapses under carrier-grade NAT environments, where countless mobile subscribers route through shared gateways and end up throttled together as one abusive caller.

Effective protection relies on tiered defenses: broad IP constraints at the perimeter, fine-grained token limits in the application core, and system-wide shedding mechanisms to insulate primary databases from saturation. Every tier handles a separate threat vector and carries distinct failure characteristics.

Transparency matters more than strict limits. Returning an explicit 429 response with a Retry-After header and descriptive error payload calms downstream clients, whereas opaque drops provoke aggressive retry loops.