Cross-post. Original: stellarbytecapital.com/blog/api-rate-limiting
Rate limiting looks trivial — "just count requests and block over N" — and quietly turns into a distributed-systems problem the moment you have more than one server, bursty traffic, or clients you actually care about. Done well, it protects your API from abuse and absorbs spikes without punishing legitimate callers. Done naively, it drops good requests, lets bad ones through, and lies to clients about when they can retry.
What you're actually protecting against
Be clear which goal you mean — the design differs:
Overload protection — keep a spike from taking down the service.
