No Rate Limiting API: Example and Risk
A real example of what happens when an API has no rate limits—and how to fix it.
What this problem means
Your API is reachable from the internet. Without rate limiting, a single client—or attacker—can send unlimited requests. Bots scrape data, abuse your infrastructure, or amplify your cloud and AI API costs.
Why this is dangerous
- Cost amplification: Each request may trigger expensive downstream calls. Unlimited requests = unlimited bills.
- Scraping: Competitors or bad actors can extract your data at scale.
- Denial of service: A flood of requests can overwhelm your servers.
Real-world example
A SaaS company exposed a public API for a free tier. A script was written to automate signups and extract data. Within a week, the API was called millions of times. The company had no rate limits, no WAF, and no alerts. The resulting AWS and third-party API bills exceeded $50,000. A simple rate limit of 100 requests per minute per IP would have stopped the abuse.
How to fix it
1. API Gateway: Use AWS API Gateway, Cloudflare, or similar to enforce throttling per API key or IP.
2. Application-level: Libraries like express-rate-limit (Node.js) or equivalent in your stack.
3. Per-user limits: Tie limits to authenticated users or API keys.
4. Monitor: Set up alerts for unusual traffic patterns.
Tools and configurations
- AWS API Gateway: Built-in throttling and usage plans.
- Cloudflare: Rate limiting rules at the edge.
- express-rate-limit: Simple middleware for Node.js/Express.
- Redis: For distributed rate limiting across instances.
Common mistakes
- Assuming "we're too small to be targeted."
- Only limiting by IP (easily bypassed with proxies).
- No monitoring—discovering abuse only when the bill arrives.
Quick checklist
- [ ] Add rate limiting at API Gateway or application level
- [ ] Set per-user or per-key limits where possible
- [ ] Monitor for anomalous traffic
- [ ] Configure billing alerts as a backstop
Need help with production readiness? Get a free 30-minute audit.
Book Free 30-Min Production AuditCheck if your system has this risk
Take the 60-second production readiness assessment to identify gaps in your infrastructure.
Start AssessmentFrequently asked questions
- What is the risk of no rate limiting on an API?
- Unlimited requests lead to abuse, scraping, cost explosions, and denial of service. Bots and attackers exploit unprotected APIs within hours.
- How do I add rate limiting to my API?
- Use an API Gateway (AWS, Cloudflare) with built-in throttling, or add application-level middleware like express-rate-limit. Tie limits to API keys or authenticated users.
- What rate limit should I use?
- Start with 100-1000 requests per minute per user or API key. Adjust based on typical usage and cost per request.