What is a rate limit?
A rate limit caps how many requests a client can make to an API in a short window, such as 100 requests a minute, to protect the service from overload and abuse.
Rate limit vs quota
A rate limit controls frequency over seconds or minutes. A quota controls total volume over a billing period, such as 100,000 calls a month. A client can be well within its monthly quota and still hit the rate limit by sending a burst.
What happens when a rate limit is exceeded
The API rejects the extra requests, conventionally with HTTP 429 Too Many Requests and often a Retry-After header saying when to try again. Clients should back off and retry later rather than hammering the API, which only extends the block. A rate limit exceeded error is a signal to slow down, not a failure to show users straight away.
Rate limiting algorithms
- Fixed window: count requests per clock minute; simple, but allows bursts at the window edges.
- Sliding window: count requests over the last 60 seconds at any moment; smoother.
- Token bucket: tokens refill at a steady rate and each request spends one, allowing short bursts up to the bucket size.
- Leaky bucket: requests drain at a constant rate, smoothing traffic completely.
Rate limits and billing
Rate-limited calls should never be billed. Micro SaaS API Marketplace records failed and rate-limited calls but never bills them, and its quota enforcement holds under concurrent calls, so a burst cannot slip past a limit.
Last reviewed 2026-11-01.