Course outline

01 · HTTP & REST APIs

02 · Databases & Persistence

03 · Authentication & Authorization

04 · API Design & gRPC

05 · Caching, Queues & Background Jobs

06 · Production-Ready Services

07 · Advanced Auth & Tenant Security

08 · Performance & Caching at Scale

09 · Testing & Release Confidence

Stage 3 · Build

Caching, Queues & Background Jobs

Rate Limiting

Implement token buckets, leaky buckets, per-user quotas, Redis counters, and HTTP 429 responses.

8 min readBuilding Backend ApplicationsBuild

Why Rate Limit

Rate limiting protects your API from abuse, ensures fair usage, and prevents cascading failures. Without rate limits, a single client can exhaust your resources and cause downtime for all users.

Token Bucket

The token bucket algorithm adds tokens at a fixed rate. Each request consumes a token. When the bucket is empty, requests are rejected. This allows bursts while enforcing an average rate.

Gotoken-bucket-middleware.go

29 linesLn 1, Col 1Go

rate.NewLimiter creates a token bucket. The first argument is the refill rate (requests per second). The second is the bucket size (burst capacity). Allow() returns false when the bucket is empty.

Sliding Window

Gosliding-window-rate-limiter.go

33 linesLn 1, Col 1Go

The sliding window tracks timestamps of recent requests in a sorted set. On each request, remove expired entries and count remaining. This provides accurate rate limiting without boundary issues.

Per-User Quotas

Goper-user-rate-limiting.go

32 linesLn 1, Col 1Go

Use INCR to atomically increment a counter per user per window. Set TTL on the first increment. Return 429 when the limit is exceeded. Include rate limit headers in every response.

Redis Counters

Redis provides atomic counters that work across multiple application instances. INCR is atomic and fast. Combined with EXPIRE, it implements rate limiting without locks.

Goredis-counter-patterns.go

15 linesLn 1, Col 1Go

INCR is atomic — no race conditions even with concurrent requests. EXPIRE sets the TTL. This is the simplest rate limiting pattern for single-window limits.

HTTP 429 Responses

When rate limiting kicks in, return HTTP 429 Too Many Requests. Include headers that tell the client when to retry. This helps clients implement proper backoff logic.

Gorate-limit-response-headers.go

10 linesLn 1, Col 1Go

X-RateLimit-Limit shows the maximum. X-RateLimit-Remaining shows how many are left. X-RateLimit-Reset shows when the window resets. Retry-After tells clients when to retry.

Rate limit by different keys

Rate limit by IP for anonymous endpoints. Rate limit by user ID for authenticated endpoints. Rate limit by API key for third-party integrations. Use different limits for different tiers.

Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.