API Throttling - Wikekos Blog

What is API Throttling?

API throttling is a technique to control the rate of requests between a client and server to prevent abuse and ensure fair usage. This prevents DDoS attacks and resource exhaustion.

Key Concepts:

• Request rate limits (requests per minute)
• Time windows (sliding vs fixed window)
• Token buckets and leaky bucket algorithms
• Rate limit headers (e.g., X-RateLimit-Remaining)
• IP address or token based tracking

Why Should You Care?

Proper API throttling protects your infrastructure from overload while maintaining a good developer experience. It's a fundamental part of API security and scalability.

Read time: 8 min

Throttling in Action


# Express.js middleware example:
app.use((req, res, next) => {
  const ipAddress = req.ip;
  const rate = redis.get(`api-rate:${ipAddress}`);
  if (rate >= 100) {
    return res.status(429).json({ error: 'Rate limit exceeded' });
  }
  redis.incr(`api-rate:${ipAddress}`);
  return next();
});

Redis-based IP rate limiting in Express

• Token bucket algorithm
• Sliding window counting

Throttling Implementation

Explore different throttling patterns and their tradeoffs in modern API design.

Fixed Window

Easiest to implement but can lead to bursts of requests

Count requests in fixed intervals (e.g., one minute). Simple but allows request bursts at window boundaries.

Sliding Window

More accurate but requires complex logging

Tracks requests with timestamps in a sliding window period to prevent burst attacks. More accurate than fixed windows.

Token Bucket

Balances fairness and accuracy with burst tolerance

Requests consume tokens from a replenishing bucket. Handles bursts up to token capacity before throttling.

Best Practices for Implementation

Learn how to implement throttling effectively in your applications

1. Choose Appropriate Limits

Adjust based on API workload
Use different tiers for free vs paid users
Grace period after limit reached

2. Monitor Effectively

Track metrics like:

• Peak hourly rates
• Failed requests due to throttling
• Client-specific patterns

Prometheus CloudWatch New Relic

Implementation Checklist

✅ Use sliding window for accuracy
✅ Store state in fast cache
✅ Provide clear error responses

✅ Monitor and log throttled requests
✅ Allow rate increases for business clients
✅ Test with realistic load scenarios

Code Example

Here's how to implement API throttling with Redis and Express.js

redis

express


const Redis = require('ioredis');
const redis = new Redis();

app.use('/api', async (req, res, next) => {
  const ip = req.ip;
  
  const key = `rate-limit:${ip}`;
  const window = 60 * 5; // 5 minute window
  
  try {
    const count = await redis.get(key);
    
    if (count >= 100) {
      return res.status(429).json({
        error: 'Too Many Requests',
        retry_after: Math.ceil((window - (Date.now() - lastRequestAt)) / 1000)
      });
    }
    
    // Store current timestamp
    await redis.multi()
      .set(key, Date.now())
      .expire(key, 300) // 5 minutes expiration
      .exec();
    
    next();
  } catch (err) {
    next(err);
  }
});

120 requests in 300 ms Express.js

Frequently Asked Questions

What's the standard rate limit size?

Common default limits are 100-1000 requests per minute, but should be adjusted based on API sensitivity and infrastructure capacity.

Should I throttle admin requests?

Always implement minimum throttling for API keys to prevent accidental or malicious abuse of administrative endpoints.

How to handle rate limit errors?

Return HTTP 429 Too Many Requests with a Retry-After header and a JSON error message with remaining reset time.

API Throttling Explained