How do I add rate limiting to AWS API Gateway?

Set throttle limits in API Gateway (Settings or per-stage). Create usage plans and attach to API keys for per-key limits. Monitor with CloudWatch.

What is a usage plan in API Gateway?

A usage plan defines throttle and quota limits. Attach it to API keys. Each key gets its own limits. Good for multi-tenant or tiered APIs.

How do I set per-API-key rate limits?

Create a usage plan with throttle and quota. Create API keys and attach them to the usage plan. Each key gets the plan's limits.

API Gateway Rate Limiting in AWS | StackRail

What this problem means

Your API runs on AWS. You need rate limiting to prevent abuse. API Gateway has built-in throttling—you can set limits per API, per stage, or per API key. No application code changes needed.

Why this matters

- Abuse prevention: Rate limiting slows down scrapers and attackers.

- Cost control: Fewer abusive requests = lower Lambda and downstream costs.

- Built-in: No need to implement rate limiting in your application.

Real-world example

A startup had an API with no rate limits. A script was written to automate millions of requests. They added API Gateway throttling—1000 requests per second per account, 100 per second per API key—in the console. Abuse dropped by 90%. No code deployment.

How to fix it

1. Account-level throttling: In API Gateway, set default throttle (e.g., 1000 req/s, 10000 req/day).

2. Usage plans: Create plans (e.g., Free: 100 req/day, Pro: 10000 req/day). Attach to API keys.

3. Per-key limits: Tie usage plans to API keys. Each key gets its own quota.

4. Per-method limits: Override per endpoint if needed.

5. Monitor: Use CloudWatch to see throttling and 429 responses.

Tools and configurations

- API Gateway: Throttling settings, usage plans.

- API keys: Attach to usage plans for per-key limits.

- CloudWatch: Monitor throttle and 429 metrics.

Common mistakes

- Setting limits too low (blocks legitimate users).

- No monitoring—not knowing if throttling is working.

- Only account-level limits (per-key is better for multi-tenant).

Quick checklist

- [ ] Set account-level throttle (e.g., 1000 req/s)

- [ ] Create usage plans for different tiers

- [ ] Attach API keys to usage plans

- [ ] Monitor for 429 and throttle metrics

- [ ] Adjust limits based on usage

Need help with production readiness? Get a free 30-minute audit.

Book Free 30-Min Production Audit

View our DevSecOps services

Check if your system has this risk

Take the 60-second production readiness assessment to identify gaps in your infrastructure.

Start Assessment

Related guides

Frequently asked questions

How do I add rate limiting to AWS API Gateway?: Set throttle limits in API Gateway (Settings or per-stage). Create usage plans and attach to API keys for per-key limits. Monitor with CloudWatch.
What is a usage plan in API Gateway?: A usage plan defines throttle and quota limits. Attach it to API keys. Each key gets its own limits. Good for multi-tenant or tiered APIs.
How do I set per-API-key rate limits?: Create a usage plan with throttle and quota. Create API keys and attach them to the usage plan. Each key gets the plan's limits.