Rate limiting
Capping how often someone can call an action in a given time, which blocks abuse, guessing attacks and runaway costs.
Updated October 2026 · with examples from our own builds
What does rate limiting mean in practice?
A rate limit says, for example, that one IP address may try a passcode only so many times in ten minutes, or that a free user may run a set number of AI scans a day. Requests over the limit get a clear refusal, usually HTTP 429, instead of being processed.
Limits serve security and budget at once. They stop password guessing and spam, and they cap the bill when each request costs money, such as an SMS, a maps call or an AI model. The refusal message is product copy too: it can explain the limit and offer an upgrade.
Tuning matters. Too tight and genuine users are locked out mid-task; too loose and the limit protects nothing.
Rate limiting at a glance
- Protects
- Logins and passcodes, spam, and paid API spend
- Standard response
- HTTP 429 with a clear message
- Tune for
- Real heavy users, not just attackers
Where has rate limiting come up in our builds?
At a plan's daily AI cap the API answers with a 429 and an upgrade message built from the same tier table, so the copy can never quote a stale number. Quotas reset at midnight UTC.
The contact form is rate-limited and honeypotted, password attempts on client report links are rate-limited, and each director's card link accepts up to 20 cards a minute.
Capturing the apps against a local backend with no Google key showed that when Google returns no route, the booking preview kept retrying until the rate limiter answered 429. The gap is on record: failed fetches need the same back-off as successful ones.
Common questions about rate limiting
Will rate limits annoy my real users?
Only if they are set without looking at real use. Size them for your heaviest genuine user, count only the actions that matter, and have the refusal message say when they can try again.
Should failed requests count towards a limit?
For guessing attacks, yes: failed passcode attempts are exactly what to count. For uploads or scans, consider counting only completed work, so someone working quickly isn't locked out by a brute-force guard.
Related terms
Sources
Planning a product and not sure where rate limiting fits? Ask us, or browse all 116 terms in the glossary.