I Rate-Limited an API by Hand. Then I Configured One in a Form Field.

I set up an API endpoint that had no rate limiting. To test the impact of limiting requests, I published it through a third-party API management platform as a managed API proxy. The backend remained on my own machine, behind a tunnel, while the platform gateway managed the rate limit.

I initially set the limit to 5 requests per 60 seconds. However, when I sent 10 requests roughly a second apart, only two of them hung for 60 seconds each due to unexplained gateway timeouts. This led me to incorrectly assume that the limit wasn't being enforced because the spacing between requests was too slow.

Upon further testing, I sent all 10 requests on a fixed 200ms schedule, starting 2 seconds after a new minute began. This ensured that all requests fell within the same clock minute. As a result, exactly 5 requests were allowed through, and 5 were rejected, precisely at the configured limit. The response headers confirmed this behavior, with the "x-ratelimit-reset" header indicating the count resetting at the start of the minute, not 60 seconds after the first request.

I also measured the impact of the rate limit by checking a request counter on my backend, which is only reachable through the tunnel. The counter only increased by 4 after the burst of requests, indicating that the rejected requests did not reach my backend. This confirmed that the rate limiting was indeed working correctly at the gateway level, preventing any further requests from reaching my backend.