API Rate Limiting: Algorithms and How to Build One
One client stuck in a retry loop with no backoff can put more load on your API in a minute than your other ten thousand clients combined. From your side it won’t look like an attack. It looks like a bug on their end, and it becomes an incident on yours. A rate limiter caps that client before it gets there. What does a rate limiter actually decide? On every request, the limiter asks one thing: has this key made too many requests in the current window? Three choices turn that into something you can implement. ...