Rate Limiting for API Requests

Rate limiting protects an API from abuse, accidental infinite loops in client code, and traffic spikes, by capping how many requests a client can make within a given time window.

The throttle Middleware

Laravel ships with a throttle middleware that can be applied to any route or route group.

Route::middleware('throttle:60,1')->group(function () {
    Route::get('/posts', [PostController::class, 'index']);
});

This example allows 60 requests per 1 minute per client.

Named Rate Limiters

For more control, rate limiters can be defined in a service provider using the RateLimiter facade, keyed by user ID or IP address.

RateLimiter::for('api', function (Request $request) {
    return Limit::perMinute(100)->by($request->user()?->id ?: $request->ip());
});

What Clients See When Limited

• A 429 Too Many Requests response once the limit is hit
• X-RateLimit-Limit and X-RateLimit-Remaining headers on every response
• A Retry-After header telling the client when to try again

With the API itself secured and throttled, the course now shifts from request/response handling to background processing, starting with events and listeners.