MediumExperience level: 3-5 years · 8-15 years1 min read

How do you design API rate limiting, and what do you return when a client exceeds it?

Reviewed by Gurusankar M.

Asked inAmazonGoogleMicrosoft
#rate limiting#token bucket#429#retry-after#throttling
Report issue

Short Answer

Use a token-bucket or sliding-window limiter keyed per client/API key (in Redis for distributed enforcement). On exceed, return 429 Too Many Requests with a Retry-After header; expose limit/remaining/reset headers so well-behaved clients can self-throttle.

On this page

Concept Made Simple

Coffee Chat Question

“How do you design API rate limiting, and what do you return when a client exceeds it?”

Remember It Faster

Mind Map Answer

Algorithm
token bucket / sliding window
Key by
API key / user / IP
Exceed
429 + Retry-After
Headers
X-RateLimit-Limit/Remaining/Reset

Think Beyond the Expected

What If?

Why does rate limiting need a shared store like Redis in a multi-instance deployment?

Per-instance counters let a client multiply their limit by the number of instances (and counts reset on deploys). A shared store (Redis) — or the API gateway — enforces one global limit across all instances consistently.

Real World

Rate limiting protects against abuse, runaway clients, and cost blowouts; it's usually enforced at the API gateway with Redis-backed counters and standard 429 + Retry-After semantics.

Interviewer's Expectation

Keywords they're listening for:

  • token bucket/sliding window
  • per-client key
  • 429 + Retry-After
  • rate-limit headers
  • shared store for distributed

Common Mistakes

  • Per-instance counters (limit multiplied)
  • Returning 503 instead of 429
  • No Retry-After / rate headers

Best Practices

  • Enforce centrally (gateway + Redis)
  • Return 429 + Retry-After + limit headers
  • Tune burst vs sustained with token bucket

Follow-up Questions

  1. Token bucket vs sliding window vs fixed window?
  2. Where do you enforce it — gateway or app?
  3. How do you handle burst vs sustained rate?

Continue Learning with AI

Take this question deeper with your favourite AI assistant. Pick a depth, copy the prompt, or open it directly — AI is your learning companion, not a shortcut.

Plain-language foundations

I'm preparing for a software engineering interview and want to understand this from scratch, as a beginner.

Topic: Auth (REST APIs)
Interview question: "How do you design API rate limiting, and what do you return when a client exceeds it?"

Please:
1. Explain the core idea in simple, plain language, using an everyday analogy.
2. Define any technical terms you use.
3. Walk through one small, concrete example.
4. Finish with a single sentence I can easily remember.

Keep the tone friendly and assume I'm new to this topic.
Open inChatGPTGeminiClaude

Was this answer helpful?

Affiliate links

Tools for Your Developer Workspace

Equipment for a comfortable, productive setup.

As an Amazon Associate I earn from qualifying purchases.