Dimensions
RPM: requests per minute. TPM: tokens per minute. Cost: dollar cap per day. Combine — some abuse hits one, some others.
Advertisement
Per-user
Different from per-IP. Auth-tied. Free/paid tiers with different limits. Anonymous → strictest.
Advertisement
Sliding window
Not fixed. Every 60s of rolling data. Fair + prevents burst-at-window-edge abuse.
Backpressure
Return 429 with Retry-After. Rate-limited jobs go to queue. Backoff strategy for clients.