API management · Guide
API rate limiting: how to choose limits and quotas, and where Kong fits
API rate limiting caps how many requests a caller may send in a period of time, so one partner, script or runaway client cannot slow every other consumer down or run up the bill of a service behind the gateway. This guide explains the common methods in plain words, what to count against, how quotas differ from rate limits, how limits work for traffic to large language models, and how Interkey sets them on Kong for organisations in Saudi Arabia.
Published 9 min read
In short, for executives
- What it is: a rule at the gateway that refuses calls beyond an agreed rate, per consumer and per route.
- Why it matters: it keeps shared services available, makes fair use enforceable in partner agreements and caps spend on paid back ends.
- What it does not do: it does not stop a determined attack on its own or fix a slow service; it limits the damage.
- Where Kong fits: rate limiting is a gateway plugin; finer control is in the Enterprise edition, and token limits for LLM traffic sit in Kong AI Gateway.
At a glance
| Question | Answer |
|---|---|
| What it controls | Requests per second, minute, hour or day, per consumer, route or user |
| What a caller sees when refused | Usually HTTP status 429 Too Many Requests, often with a Retry-After header |
| Rate limit or quota | A rate limit protects capacity over seconds or minutes; a quota is an allowance over a day or a month |
| For LLM traffic | Count tokens or cost, not requests |
| Kong plugins | Rate Limiting; Rate Limiting Advanced (Enterprise); AI Rate Limiting Advanced for LLM traffic |
| From Interkey | Limits set from measured usage, configured as code, monitored, with support from Riyadh |
The problem API rate limiting solves, in plain words
An API without limits trusts every caller to behave. In practice a partner's batch job retries in a tight loop, a mobile release polls every second instead of every minute, or a leaked key is used to scrape data. Each of these is ordinary traffic to the gateway, and each can use up the database connections, threads or third-party credits that every other consumer depends on.
Read more
A rate limit turns that shared capacity into allowances. Each consumer gets a rate it may use, and calls beyond it are refused quickly at the gateway, before they reach the service. The well-behaved consumers keep working, and the team that owns the misbehaving client sees a clear refusal instead of a slow failure.
Why API throttling matters for organisations in the Kingdom
Many Saudi organisations now expose APIs to partners, government platforms, fintechs and their own mobile apps at the same time. Seasonal peaks, such as salary days, Ramadan evenings or the start of a school term, put several of these consumers under load together. API throttling decides who keeps service when capacity is short.
Limits are also a contract term. When an agreement promises a partner a number of calls, the gateway is where that promise is measured and enforced, and its logs are the record both sides read. And where the back end is a paid service, a cloud function or a model provider, limits keep one consumer from turning into an unplanned invoice.
Rate limiting methods: fixed window, sliding window and token bucket
Each method answers the same question, "may this call go through now", with a different trade-off between simplicity, fairness at the edges of a period and tolerance for short bursts.
| Method | How it counts | Strength | Watch for |
|---|---|---|---|
| Fixed window | Counts calls in fixed periods, such as each minute on the clock, and resets at the start of the next | Simple to understand, cheap to compute, easy to explain to partners | A caller can send a full allowance at the end of one minute and another at the start of the next |
| Sliding window | Counts calls over the last period, measured back from now, so the window moves with time | Smooths the edge effect of fixed windows; fairer under steady load | Slightly more work per call; the exact behaviour depends on the product |
| Token bucket | A bucket refills at a steady rate; each call takes one token; an empty bucket refuses calls | Allows short bursts up to the bucket size while holding the average rate | Bucket size and refill rate both need setting, and both need explaining |
| Concurrency limit | Caps how many calls from one caller are in progress at once | Protects slow back ends where a few long calls do the harm | Does not limit fast calls, so it is used beside a rate limit, not instead of one |
Which methods a given gateway product offers, and under which licence, changes over time. On Kong we confirm the window types and options against Kong's current plugin documentation before design.
What to count against: consumer, route, rate limit per user and quotas
A limit is only as fair as the identity it counts against. Counting by IP address is a weak default: many users in one company share an address, while one abuser can rotate through many.
- Per consumer. Each partner, app or internal team authenticates at the gateway and has its own limit. This is the base of every plan.
- Per route. A search or report endpoint costs far more than a status check, so expensive routes get a lower limit than cheap ones.
- Per user. A rate limit per user, read from a verified token, stops one person in a large consumer from using that consumer's whole allowance.
- Login and token endpoints. These get strict limits of their own, as our API security page explains, against password guessing.
Read more
Quota management: daily and monthly allowances
A rate limit protects capacity in the short term. A quota sets an allowance over a longer period, such as calls per day or per month, and usually comes from a commercial or contractual decision: a partner tier, a paid plan or a budget agreed with an internal team.
Quota management works when three things are written down: who owns each quota, what happens when it runs out (refuse, slow down or allow and bill), and how a consumer asks for more. Consumers should see their usage before they reach the end, through response headers, the developer portal or a regular report, so a refusal is never the first warning.
Relateddeveloper portal
Token rate limiting for LLM traffic
Calls to large language models differ: one request may cost a few tokens or many thousands. Counting requests says little about load or spend, so limits for this traffic count tokens, or cost, instead.
Kong documents its AI Rate Limiting Advanced policy as counting tokens or cost rather than requests, with limits per consumer, consumer group, model or provider, so one team's experiment cannot use up another team's budget. Kong labels it "AI License Required", part of its AI Gateway Enterprise offering. Our Kong AI Gateway page covers the cost formula and the other AI policies; our planned LLM gateway guide covers the wider design.
RelatedKong AI Gateway page
A checklist before you set API rate limits
- Every consumer authenticates at the gateway, so limits count against a known identity.
- Current usage per consumer and per route is measured for at least a few weeks, including a peak.
- Expensive routes, login and token endpoints have their own lower limits.
- Burst tolerance is decided: whether short spikes above the average are allowed, and how large.
- Quotas, where used, have an owner, a reset period and a written way to ask for more.
- Refused calls return a clear status and, where possible, when to retry.
- Consumers can see their usage before they reach a limit.
- Rate-limit hits are logged per consumer and someone is alerted when a key consumer is refused.
- Limits live in version-controlled configuration and change through review, not by hand on a node.
- Limits are tested in a non-production environment with the consumers' real call patterns.
Where Kong fits for API rate limiting, and where it does not
Kong is the gateway Interkey implements. Rate limiting in Kong is a plugin on the gateway, declared with the rest of the configuration.
| Need | In Kong | What to know |
|---|---|---|
| Basic limits per consumer | Rate Limiting plugin | Not marked Enterprise only |
| Limits shared across gateway nodes | Rate Limiting with the cluster strategy | Needs the traditional deployment, where nodes connect to a database |
| Finer control of windows and limits | Rate Limiting Advanced | Enterprise only |
| Caps on request size | Request Size Limiting | Not marked Enterprise only |
| Token and cost limits for LLM calls | AI Rate Limiting Advanced in Kong AI Gateway | Part of the AI Gateway Enterprise offering |
| Business logic limits, such as transfers per customer per day | Not the gateway's job | Belongs in the service, which knows the customer and the transaction |
Where it does not fit. A gateway counts calls; it does not know that a call moves money or books a seat. Limits that depend on the meaning of a transaction belong in the service. A rate limit also does not replace protection against large network floods in front of the gateway, or an unsafe service behind it. Our API gateway page explains the deployment options, and how data planes keep enforcing their last configuration if the control plane goes offline.
What drives cost and timeline
Basic limits on a running Kong gateway are a configuration change. A full programme takes longer, and we estimate it after looking at your traffic, not before. What drives the effort: how many APIs and consumers are in scope, whether consumers already authenticate at the gateway, whether usage data exists, whether quotas are tied to contracts, and how many environments need the same rules.
Kong licensing, where Rate Limiting Advanced or AI Gateway policies are needed, is quoted at Kong's terms, on a separate line from Interkey's work.
How Interkey helps you set API rate limits
-
Measure.
Read current traffic per consumer and route from the gateway logs or your observability platform.
-
Write the policy.
Limits, bursts, quotas and refusal behaviour per consumer type, agreed with the API owners.
-
Configure as code.
Plugins declared with decK, reviewed and tested before production.
-
Roll out gently.
Log-only or generous limits first, then tightened once consumers are told.
-
Support.
Support from Riyadh in Arabic and English, or operation under a written managed services scope.
Questions buyers ask about API rate limiting
What is the difference between API rate limiting and API throttling?
The terms are often used for the same thing. Where they are separated, rate limiting refuses calls above the limit, while throttling slows them down or queues them. Most gateways refuse, because queuing at the gateway holds connections open and moves the pressure rather than removing it.
Which rate limiting method should we start with?
For most partner and mobile APIs a sliding window per consumer is a sound start, because it is fair at the edges of a period. A token bucket suits consumers that send short bursts. A fixed window is fine where limits are generous and simplicity matters most.
How do we choose the right limit for each partner?
From measured usage, not a default. We read a few weeks of traffic per consumer, including a peak, set the limit above normal use with room for growth, and agree it with the API owner and the partner before it is enforced.
Do we need Kong Enterprise for rate limiting in KSA?
Not for basic limits: Kong's Rate Limiting plugin is not marked Enterprise only. Rate Limiting Advanced and the AI Gateway token limits are. Licensing is quoted at Kong's terms after we check your requirements against Kong's current plugin list.
Can rate limit counters and logs stay inside Saudi Arabia?
Yes, where the gateway runs in the Kingdom. Counters are held by the data planes or their database, which can run on your servers or in a cloud region inside the Kingdom. Where logs and metrics are sent afterwards is a separate decision for your data classification.
How long does it take to introduce rate limits without breaking consumers?
It depends on how many consumers you have and whether they already authenticate at the gateway. The configuration is quick; measuring usage, agreeing limits and telling consumers take longer. We start in log-only mode and give an estimate once the traffic has been read.
Next
Read next
Next step
Review your API limits with us
Tell us which APIs you expose, who consumes them, the gateway you run today and where limits have caused trouble. We will propose limits per consumer and route, and the steps to apply them without breaking anyone.
Or directly
+966-11-2180999 [email protected]Tawuniya Towers, North Tower, 7th Floor, King Fahad Highway, Olaya, P.O. Box 56835, Riyadh 11564, Saudi Arabia