domains / families / security / implementing-api-rate-limiting-and-throttling

implementing-api-rate-limiting-and-throttling

separate

'Implements API rate limiting and throttling with token bucket, sliding

When to use

• Protecting authentication endpoints against brute force and credential stuffing attacks
• Preventing API abuse and resource exhaustion from automated scripts and bots
• Implementing fair usage quotas for different API consumer tiers (free, premium, enterprise)
• Defending against denial-of-service attacks at the application layer
• Meeting compliance requirements that mandate API abuse prevention controls

When not to use

• Sole defense against attacks without authentication, authorization, or WAF

Skill page

Source