Limit how often anyone can call your APIs

How to do it

Count requests per client over a short window, such as 60 a minute. Answer 429 Too Many Requests with a Retry-After header when a client goes over. Send the RateLimit headers from the IETF draft so well-behaved agents can slow down. Behind a proxy, trust its forwarded address, or every visitor counts as one. Logins need more, such as two-factor login, as in slow down password guessing.

Example

HTTP/2 429
retry-after: 42
ratelimit-policy: "per-minute";q=60;w=60
ratelimit: "per-minute";r=0;t=42

// Express: one limiter in front of every endpoint that does work
import rateLimit from 'express-rate-limit';
app.set('trust proxy', 1);
app.use(['/api', '/mcp', '/ask'], rateLimit({ windowMs: 60_000, limit: 60, standardHeaders: 'draft-8' }));

How to check

Send more requests than the limit in a loop. The extra ones get 429, and normal pages are not affected.