Rate Limiting Your API: Best Practices Every Developer Should Know

import redis
import time
from fastapi import Request, HTTPException

r = redis.Redis(host="localhost", port=6379, decode_responses=True)

def is_rate_limited(
    key: str,
    limit: int,
    window_seconds: int,
) -> tuple[bool, int, int]:
    """
    Sliding window counter using two Redis keys.
    Returns: (is_limited, current_count, remaining)
    """
    now = int(time.time())
    current_window = now // window_seconds
    previous_window = current_window - 1

    current_key = f"{key}:{current_window}"
    previous_key = f"{key}:{previous_window}"

    pipe = r.pipeline()
    pipe.get(current_key)
    pipe.get(previous_key)
    current_count_raw, previous_count_raw = pipe.execute()

    current_count = int(current_count_raw or 0)
    previous_count = int(previous_count_raw or 0)

    # Weight previous window by how much of it is still "in" the window
    elapsed_in_window = now % window_seconds
    previous_weight = 1 - (elapsed_in_window / window_seconds)
    estimated_count = current_count + (previous_count * previous_weight)

    if estimated_count >= limit:
        return True, int(estimated_count), 0

    # Increment current window counter
    pipe = r.pipeline()
    pipe.incr(current_key)
    pipe.expire(current_key, window_seconds * 2)
    pipe.execute()

    remaining = max(0, limit - int(estimated_count) - 1)
    return False, int(estimated_count) + 1, remaining


# FastAPI middleware
from fastapi import FastAPI
from fastapi.responses import JSONResponse

app = FastAPI()

@app.middleware("http")
async def rate_limit_middleware(request: Request, call_next):
    client_ip = request.client.host
    path = request.url.path

    # Strict limit on auth endpoints
    if path.startswith("/auth/"):
        key = f"rate:ip:{client_ip}:auth"
        limited, count, remaining = is_rate_limited(key, limit=10, window_seconds=60)
    else:
        key = f"rate:ip:{client_ip}:global"
        limited, count, remaining = is_rate_limited(key, limit=300, window_seconds=60)

    if limited:
        return JSONResponse(
            status_code=429,
            content={"error": "Too many requests. Please slow down."},
            headers={
                "Retry-After": "60",
                "X-RateLimit-Limit": str(10 if path.startswith("/auth/") else 300),
                "X-RateLimit-Remaining": "0",
            },
        )

    response = await call_next(request)
    response.headers["X-RateLimit-Remaining"] = str(remaining)
    return response

const Redis = require("ioredis");
const redis = new Redis();

// Token bucket rate limiter
async function tokenBucket(key, { capacity, refillRate, refillPeriodMs }) {
  const now = Date.now();
  const bucketKey = `bucket:${key}`;

  const result = await redis
    .multi()
    .hgetall(bucketKey)
    .exec();

  const data = result[0][1];
  let tokens = data?.tokens ? parseFloat(data.tokens) : capacity;
  let lastRefill = data?.lastRefill ? parseInt(data.lastRefill) : now;

  // Refill tokens based on elapsed time
  const elapsed = now - lastRefill;
  const tokensToAdd = (elapsed / refillPeriodMs) * refillRate;
  tokens = Math.min(capacity, tokens + tokensToAdd);
  lastRefill = now;

  if (tokens < 1) {
    // Calculate when the next token will be available
    const msUntilToken = ((1 - tokens) / refillRate) * refillPeriodMs;
    return { allowed: false, remaining: 0, retryAfterMs: Math.ceil(msUntilToken) };
  }

  tokens -= 1;

  await redis
    .multi()
    .hset(bucketKey, "tokens", tokens.toString(), "lastRefill", lastRefill.toString())
    .pexpire(bucketKey, refillPeriodMs * 2)
    .exec();

  return { allowed: true, remaining: Math.floor(tokens), retryAfterMs: 0 };
}

// Express middleware
function rateLimitMiddleware(config) {
  return async (req, res, next) => {
    const key = req.user?.id
      ? `user:${req.user.id}`
      : `ip:${req.ip}`;

    const result = await tokenBucket(key, config);

    res.setHeader("X-RateLimit-Limit", config.capacity);
    res.setHeader("X-RateLimit-Remaining", result.remaining);

    if (!result.allowed) {
      res.setHeader("Retry-After", Math.ceil(result.retryAfterMs / 1000));
      return res.status(429).json({ error: "Rate limit exceeded." });
    }

    next();
  };
}

// Apply to Express app
const express = require("express");
const app = express();

// Strict limit for login
app.post(
  "/auth/login",
  rateLimitMiddleware({ capacity: 5, refillRate: 1, refillPeriodMs: 60_000 }),
  loginHandler
);

// General API limit
app.use(
  "/api/",
  rateLimitMiddleware({ capacity: 100, refillRate: 10, refillPeriodMs: 1_000 }),
);

# Example response headers on a normal request
HTTP/1.1 200 OK
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 47
X-RateLimit-Reset: 1751234567

# Example response on a 429
HTTP/1.1 429 Too Many Requests
Content-Type: application/json
Retry-After: 30
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1751234597

{
  "error": "rate_limit_exceeded",
  "message": "You've exceeded 100 requests per minute. Retry after 30 seconds.",
  "retry_after": 30
}

# Python: look up tier limits from cache/DB
TIER_LIMITS = {
    "anonymous":   {"per_minute": 10,    "per_day": 500},
    "free":        {"per_minute": 60,    "per_day": 5_000},
    "pro":         {"per_minute": 300,   "per_day": 50_000},
    "business":    {"per_minute": 1_000, "per_day": 200_000},
    "internal":    None,  # no limit
}

def get_user_limits(user) -> dict | None:
    if user is None:
        return TIER_LIMITS["anonymous"]
    if user.is_internal_service:
        return None  # no limits for trusted services
    return TIER_LIMITS.get(user.subscription_tier, TIER_LIMITS["free"])

# In middleware
limits = get_user_limits(request.user)
if limits:
    limited_minute, _, remaining = is_rate_limited(
        key=f"rate:{key}:minute",
        limit=limits["per_minute"],
        window_seconds=60,
    )
    limited_day, _, _ = is_rate_limited(
        key=f"rate:{key}:day",
        limit=limits["per_day"],
        window_seconds=86_400,
    )
    if limited_minute or limited_day:
        raise HTTPException(status_code=429, detail="Rate limit exceeded")