[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_28":-5,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58},"routes/_store+/_readers+/email_author.$slug/route",{"_9":10,"_11":-5},"book",{"_12":13,"_14":15,"_16":17,"_18":19,"_20":21,"_22":23},"currentUser","id","Z2lkOi8vbGVhbnB1Yi9TdG9yZTo6Qm9va1Byb2R1Y3QvODE0MTc","title","API Rate Limiting & Throttling","state","published","contactAuthorMethod","email","aboutText","

API rate limiting is often treated as a small middleware feature.

In production, it is much more than that: it is the contract that decides who may consume shared capacity, how fast they may consume it, and what happens when demand exceeds what the system can safely serve.

This is the second book in the Production Field Manuals series. The series is written for systems that must survive real production traffic, incidents, budget pressure, and operational handoff.

This volume is a practical guide for engineers, architects, SREs, and technical leaders who need APIs to survive bursty traffic, noisy tenants, retry storms, slow dependencies, Kubernetes autoscaling delays, and cost pressure.

The book explains the business case for rate limiting, the architecture behind local and distributed quota enforcement, and the trade-offs between token bucket, fixed window, sliding window, and leaky bucket algorithms.

It shows how to choose a fairness key, where to place limiter state, how to protect downstream dependencies before they fail, and why a good limiter must become cheaper under overload.

You will also find a production-ready Go implementation shape, HTTP middleware behaviour, cancellation handling, metrics, Prometheus alert templates, rollout checklists, incident runbooks, team drills, FinOps reasoning, and a hands-on lab backed by companion source code.

The goal is not to make every request succeed. The goal is to keep the system useful when too many requests arrive.

If you build or operate multi-tenant APIs, public platforms, internal services, Kubernetes workloads, or expensive dependency paths, this manual gives you the vocabulary, design rules, and operational templates to turn overload from an incident into a controlled response.

","authors",[24],{"_12":25,"_26":27,"_28":29},"Z2lkOi8vbGVhbnB1Yi9TdG9yZTo6UHJvZHVjdEF1dGhvci84NzAyNQ","name","Luca Sepe","user",{"_30":31},"avatar",{"_32":33,"_34":35,"_36":37},"url","https://d39qdlcrvnra4b.cloudfront.net/avatars/1217142/medium/me-sf.jpg?1604849267","styleName","medium","exists",true,"shoppingCartId","shoppingCart",{"_12":71,"_72":73,"_74":37,"_75":76,"_77":78,"_79":80,"_81":37},"locale","en","readerTheme","light","constants",{"_69":70},"publishers",{"_65":66,"_67":68},"learnerOrganizations",[],"needsLocaleCookieSync",false,"announcements",{"_59":60,"_61":-5},"sentryEnvironment","production","sentryRelease","d52f98da6ef5bbaeda6aecdb4a73413f4c85e82f","announcement_store",{"_62":52,"_63":64},"announcement_authors","flag","text","

Kick off your book project, get started with GhostAI, get better at marketing, or spend the day doing all three! Free live workshops on Zoom. Saturday, June 27, 2026.

\n","companies",[],"universities",[],"paypalClientId","AX53Cwz8jR6rVVzzZiZNWWXl0dGagi-GZrjG-S3Ua14E5nrKMn7DxDQ730O4R8LusLPp49ALn6aRVaEy","no-cart","count",0,"free","updatedAt","","paymentGateway","STRIPE","cartItems",[],"loading"]

Email the Author