Rate limits protect your service from abuse, your bill from runaway clients, and your users from each other. The algorithms (fixed window, sliding window, token bucket), where to enforce limits (edge, gateway, application), what to key them on, and how to tell clients to back off properly.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
At the edge (AWS WAF rate-based rules, Cloudflare rules): per IP, cheap, stops floods before they reach you.
At the gateway (API Gateway usage plans and throttling): per API key or client.
In the application: per user, per tenant and per expensive operation, such as AI generations per day. This is the one that protects your bill.
IP addresses are shared (offices, mobile carriers) and cheap to rotate, so IP limits should be generous and aimed at floods. Authenticated limits per user or tenant are the precise ones. Expensive actions need their own limits regardless of request rate: ten requests a minute can still be a thousand-dollar day if each one runs a long model call.
Return 429 Too Many Requests (RFC 6585) with a Retry-After header.
Tell clients their remaining quota where it helps; an IETF draft standardizes RateLimit headers for this.
Make limits visible in your docs and plans, so customers can design for them.
Store counters somewhere shared (Redis or Valkey, DynamoDB), not in each server's memory, or limits multiply with instances.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
When Your App Gets Noticed: Bots, Sign-Up Abuse, SMS Pumping and DDoS
Attention brings traffic you did not want: credential stuffing, fake sign-ups, SMS fraud billed per message, scripts draining your AI budget, the occasional flood. What AWS and Cloudflare protect by default, what AWS WAF costs, and the limits we would add before the launch post.
Read
Timeouts, Retries and Idempotency: The HTTP Habits That Stop Double Charges
Every network call ends in success, failure or "we don't know". The third causes duplicate orders, double charges and stuck jobs. How status codes, timeouts, retries with backoff and idempotency keys fit together, with the limits on API Gateway and Lambda.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.