Also known as: throttling · token bucket · backpressure
Rate limiting restricts how many requests a client may make within a time window, protecting a service from overload, abuse, and runaway costs while ensuring capacity remains available to other users.
Common algorithms include the token bucket, which permits bursts while capping sustained rate, and sliding window counters, which give smoother enforcement at the cost of more state.
Rate limiting is also a security control, blunting credential stuffing, enumeration, and scraping. Against distributed attacks it is insufficient alone, since limits keyed to IP address are trivially evaded by rotating through proxy networks.
API
An API (application programming interface) is a defined contract through which one piece of software provides functionality or data to another, specifying available operations, expected inputs, and returned outputs.
Credential Stuffing
Credential stuffing is an automated attack that takes username and password pairs leaked from one breach and tries them en masse against other services, exploiting the fact that many people reuse the same password across sites.
Idempotency
An operation is idempotent if performing it multiple times produces the same result as performing it once, which allows a client to safely retry a request without risking duplicate side effects.
REST
REST (Representational State Transfer) is an architectural style for networked applications in which resources are identified by URLs and manipulated through standard HTTP methods, with each request carrying all context needed to process it.