Back to guides

Guide · Security

Public API Without Rate Limiting: The Risks

A public API with no rate limits is an open invitation for abuse. Here's what can go wrong and how to protect your endpoints.

Unlimited public APIs fail Cost Optimization—hard throttles are the pass condition. Primary control: Cost Optimization

Unlimited requests = unlimited blast radius

A public endpoint without throttles invites scrapers, accidental firmware loops, and cost amplification through databases or AI backends. Rate limiting is a Cost Optimization and Reliability control as much as a security one: it bounds how fast money and capacity can burn.

A weather widget API left open for partners was polled every second from thousands of devices after a firmware bug. The origin scaled—and so did the bill—until per-device and per-key limits plus cache TTLs landed at the edge.

Where to put the cap

Prefer the edge or gateway first (Cloudflare, API Gateway usage plans), then application middleware for business rules. Tie limits to API keys or users when you can; IP-only caps lose to proxies. Start around 100–1000 req/min per identity and tune from real traffic.

Internet → WAF / rate limit → API → expensive dependency

Watch the meter

Alert on request-rate anomalies and on spend. Discovering abuse from the monthly invoice means the limit arrived too late. Combine throttles with auth on sensitive routes and billing alerts as a backstop.

Next: Cost Optimization

Open the related pillar specification for mandatory checks, artifacts, and pass conditions. Self-attest is optional.

View Cost OptimizationSelf-attest

Related

Frequently asked questions

What happens without rate limiting on an API?
Without rate limiting, clients can send unlimited requests. This leads to abuse, scraping, cost explosions, and potential denial of service. Bots and attackers exploit unprotected APIs within hours.
How do I add rate limiting to my API?
Use an API Gateway (AWS, Cloudflare) with built-in throttling, or add application-level middleware like express-rate-limit. Tie limits to API keys or authenticated users for better control.
What is a good rate limit for APIs?
It depends on your use case. Common starting points: 100-1000 requests per minute per user or API key. Adjust based on typical usage and cost per request.
What is the risk of no rate limiting on an API?
Unlimited requests lead to abuse, scraping, cost explosions, and denial of service. A simple limit (e.g. 100 requests per minute per IP) stops most automated abuse before spend or scrape damage compounds.