Have you ever tried to copy-paste a DM to send to a ton of Facebook friends regarding your business, only to have them not go through? Congratulations! You are now the recipient of a rate limit on your API request.
When looking at the example above, we need to understand that the ramifications are much deeper than some faulty DM experience. In a post-pandemic world, our business lives, our consumer lives, and even our social lives have become more digitized than ever. Therefore, it is only natural to want to know more about API rate limiting and how it all works.
The Purpose of API Rate Limits
When an API queue is bottled up with an overwhelming number of requests, some type of rate limit service needs to be employed in order to enact a user rate limit. Three important reasons include but are not limited to the following: speed, security, and monetization.
If your docker hub is getting slammed by a cacophony of concurrent requests, you will have a very long queue, and your system can get slowed, stalled, or even worse, be forced to take a timeout. This will not make customers happy! Obviously, creating some type of throttle with a user limit to incoming requests could free up the queue at your docker hub and improve your speed immensely.
There is, of course, a more nefarious concern to keep you up at night: security. Without a rate limit service, your computer networks, web pages, IP address, HTTP response, and API responses can all be hit with cyberattacks in the form of malware, phishing, hacking, and denial of service (DOS) attacks. Because you have customers and employees to think of, you must always remember that the data you save might not always be your own. That is why you need a rate limit service in order to control the number of times an API request can be made within a given time frame. If you clog the queue, you will not have enough time to be able to have proper authentication for each API request, and that could create a very real security problem. The only API call that should reach the endpoint and have access to your data should be an authenticated user.
While not necessarily nefarious, monetization is always a concern. The customer journey needs to be a smooth one. That is why an API call needs to advance through the entire sales pipeline to the call to action at the end of the pipeline. The end of the pipeline is, of course, the endpoint of the API throttle system, and that system is worthless without a rate limit to clear up the clog at the docker hub.
Now that we understand the purpose of rate limits, let us look at some different types of rate limits.
User-level
Not all users are created equal. Therefore, the rate limit can vary depending on the user. For users that are on the bottom, this provides some sort of guarantee of fairness because all users have the same rate limit. For users that are more important to an organization, the organization can increase limits for that user.
Server-level
So many subsequent requests, so few servers … Depending on the queue at a particular server, that server may need to limit requests. Another server, however, may not have a high number of requests at that point in time and, therefore, can have a higher rate limit.
Geography-based
Because the global rate of API calls may vary depending on geography, it makes sense to have geography-based rate limits. Because we all live in different time zones, traffic may be heavy or light at different times of the day. Therefore, setting geography-based rate limits allows servers to reroute to other servers in other parts of the world to free up the queue.
With a deeper understanding of rate limits, you can better organize your business. Employing a rate limit service can help get your API request past the queue!
