{
  "id": 8636861,
  "title": "I Rate-Limited an API by Hand. Then I Configured One in a Form Field.",
  "url": "https://urgent.news/2026/09/20/i-rate-limited-an-api-by-hand-then-i-configured-one-in-a-form-field",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-20T07:21:26.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/dinukashavi/i-rate-limited-an-api-by-hand-then-i-configured-one-in-a-form-field-365d"
  },
  "original_language": "en",
  "account": "I set up an API endpoint that had no rate limiting. To test the impact of limiting requests, I published it through a third-party API management platform as a managed API proxy. The backend remained on my own machine, behind a tunnel, while the platform gateway managed the rate limit.\n\nI initially set the limit to 5 requests per 60 seconds. However, when I sent 10 requests roughly a second apart, only two of them hung for 60 seconds each due to unexplained gateway timeouts. This led me to incorrectly assume that the limit wasn't being enforced because the spacing between requests was too slow.\n\nUpon further testing, I sent all 10 requests on a fixed 200ms schedule, starting 2 seconds after a new minute began. This ensured that all requests fell within the same clock minute. As a result, exactly 5 requests were allowed through, and 5 were rejected, precisely at the configured limit. The response headers confirmed this behavior, with the \"x-ratelimit-reset\" header indicating the count resetting at the start of the minute, not 60 seconds after the first request.\n\nI also measured the impact of the rate limit by checking a request counter on my backend, which is only reachable through the tunnel. The counter only increased by 4 after the burst of requests, indicating that the rejected requests did not reach my backend. This confirmed that the rate limiting was indeed working correctly at the gateway level, preventing any further requests from reaching my backend.",
  "summary": "My hotel booking backend has an GET endpoint that has no rate limiting at all, nothing stops a client from calling it as fast as it can respond. When I needed to expose the backend publicly for a separate piece of testing, the only safe option I had was to switch that endpoint off entirely rather than risk it being hit repeatedly by anyone who found the URL. So when I published a different,…",
  "key_points": [
    "API endpoint initially unrate-limited for testing",
    "Configured 5 requests per 60 seconds limit",
    "Rate limiting enforced at gateway, not backend"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}