What should I rate limit on: IP address, user, or API key?

Key on the identity closest to the actual consumer. For authenticated APIs that means the API key or user ID, since one NAT gateway or corporate proxy can put thousands of legitimate users behind a single IP. IP-based limits still matter as an outer layer for unauthenticated endpoints like login and signup, where there is no key yet. Serious setups layer both, plus a global ceiling protecting total capacity.

Which algorithm should I pick if I just need something reasonable?

Token bucket. It allows the short bursts real clients produce, caps the sustained rate, needs only two numbers per client, and is what most gateways and Stripe-scale APIs use by default. Reach for sliding window counters when window-boundary bursts specifically hurt you, and leaky bucket when a fragile downstream needs perfectly smoothed traffic.

Is a rate limiter enough to stop a DDoS attack?

No. Application-level limiting handles abusive individual clients and modest floods, but a distributed attack from tens of thousands of sources sends few requests per source and can saturate your bandwidth before your limiter runs. Volumetric DDoS defense happens upstream, at CDNs and scrubbing layers like Cloudflare or AWS Shield. The two protections complement each other; the limiter is the fine-grained inner layer.

Architecturechapter 4 of 5 · 4 lessons

Rate Limiting

Throttle requests per user/IP to protect services from abuse and overload.

← All chapters View in cheatsheet

A customer's integration has a bug in its retry loop. At 09:14 it starts calling your API 4,000 times a second instead of four.

Your database saturates, and every other customer's requests start timing out behind it. One misconfigured cron job, and the whole platform is down.

Nobody attacked you. This is the ordinary case, and it is far more common than the malicious one: a mobile release with a polling bug, a scraper walking your identifiers, a data team backfilling through the production API.

A rate limiter turns each of those from an outage into a stream of refusals and a support conversation. It is also how you keep one noisy tenant from taxing everyone, and how the numbers on your pricing page become real.

Lessons

4 in this chapter

Why You ThrottleA rate limiter converts unbounded demand into a bounded promise you can engineer for.2 min
The AlgorithmsToken bucket, leaky bucket, fixed window, sliding window: four answers to what counts as too fast.3 min
Making Limits Hold Across a FleetTen gateways sharing one limit need shared state, and shared state costs a round trip.2 min
Telling Clients No, UsefullyA 429 with good headers turns rejected clients into cooperative ones.2 min