Rate limiting

Rate limiting caps how many requests a caller may make in a period: a hundred a minute per API key, five login attempts per account, one password reset per address per hour.

It serves three purposes at once. It stops one heavy user degrading the service for everyone, it makes brute-force attacks impractical, and it bounds the cost of anything billed per call. In front of an endpoint that calls a paid AI model, it is the difference between a bug and an invoice.

Good rate limiting tells the caller what happened: a 429 status, a header saying when to try again, and a documented limit. Silently dropping requests turns a solvable integration problem into a support ticket that takes a week to diagnose.