Introduction

Modern APIs are exposed to millions of users, partner applications, mobile apps, and third-party integrations. Without proper traffic control, a single client can overwhelm backend services, causing slow response times, increased infrastructure costs, or even complete service outages.

Rate Limiting protects APIs by restricting how many requests a client can make within a specific period. It is one of the most important security and scalability features provided by an API Gateway.

API Gateways such as Spring Cloud Gateway, Kong, Apigee, Gloo, AWS API Gateway, Azure API Management, NGINX, and Envoy implement rate limiting to protect backend services from abuse, accidental traffic spikes, bot attacks, and Distributed Denial-of-Service (DDoS) attempts.

Organizations including Google, Amazon, Netflix, Stripe, PayPal, Uber, IBM, and Microsoft rely on intelligent rate limiting to maintain high availability and ensure fair usage across millions of users.

Interviewers frequently ask about Token Bucket, Leaky Bucket, Fixed Window, Sliding Window, Redis Rate Limiter, API quotas, throttling, distributed rate limiting, and Spring Cloud Gateway implementations.

This guide covers the 15 most important API Gateway Rate Limiting interview questions with production-ready explanations, Spring Boot examples, architecture diagrams, enterprise use cases, common mistakes, and interview follow-up questions.

---

What You'll Learn

After completing this guide, you'll be able to:

• Understand Rate Limiting fundamentals.
• Differentiate throttling and rate limiting.
• Explain common rate limiting algorithms.
• Configure Redis-based rate limiting.
• Protect APIs from abuse.
• Implement rate limiting in Spring Cloud Gateway.
• Answer Rate Limiting interview questions confidently.

---

API Gateway Rate Limiting Architecture

flowchart TD
    CR["Client Requests"] --> GW["API Gateway"]
    GW --> AUTH["Authentication"]
    GW --> RL["Rate Limiter"]
    GW --> LOG["Logging"]
    RL --> RC["Redis Counter"]
    RC --> DEC{"Allow / Reject?"}
    DEC -->|Allow| BS["Backend Service"]
    DEC -->|Reject| H429["HTTP 429\nToo Many Requests"]

---

1. What is Rate Limiting?

Short Answer

Rate Limiting restricts the number of requests a client can make within a specified time period.

---

Benefits

• Prevents abuse
• Protects backend services
• Reduces infrastructure costs
• Prevents API flooding
• Ensures fair resource usage

---

Production Example

Limit

100 Requests

Per Minute

↓

101st Request

↓

HTTP 429

Too Many Requests

---

Interview Follow-up

Why is Rate Limiting implemented at the API Gateway?

Answer: The gateway is the first entry point for incoming traffic, making it the ideal place to reject excessive requests before they reach backend services.

---

2. Why is Rate Limiting Important?

Benefits

• Prevents DDoS attacks
• Controls API consumption
• Protects databases
• Ensures fair usage
• Supports monetized APIs
• Improves stability

---

Enterprise Workflow

Incoming Requests

↓

Gateway

↓

Rate Limiter

↓

Allowed

↓

Backend

---

3. What is the Difference Between Rate Limiting and Throttling?

Rate Limiting	Throttling
Restricts request count	Reduces request processing speed
Rejects excess requests	Delays requests
Usually returns HTTP 429	Usually queues or slows traffic
Protects backend	Controls traffic flow

---

Interview Tip

Many people use these terms interchangeably, but throttling generally slows traffic while rate limiting rejects requests beyond configured limits.

---

4. What is the Fixed Window Algorithm?

The Fixed Window algorithm counts requests during a fixed time interval.

---

Example

Window

1 Minute

↓

100 Requests Allowed

↓

Counter Reset

---

Advantages

• Simple
• Fast
• Easy implementation

---

Limitations

• Traffic spikes near window boundaries

---

5. What is the Sliding Window Algorithm?

Sliding Window continuously evaluates requests over the previous time interval.

---

Workflow

Current Time

↓

Previous 60 Seconds

↓

Count Requests

↓

Allow / Reject

---

Advantages

• Smooth traffic
• Better fairness
• Reduced burst issues

---

6. What is the Token Bucket Algorithm?

Token Bucket stores tokens that represent permission to process requests.

---

Workflow

Bucket

↓

Tokens Added

↓

Incoming Request

↓

Consume Token

↓

Forward Request

---

Benefits

• Supports bursts
• Smooth traffic
• High efficiency

---

Enterprise Usage

Most modern API Gateways, including Spring Cloud Gateway and Kong, support Token Bucket–style rate limiting.

---

7. What is the Leaky Bucket Algorithm?

The Leaky Bucket algorithm processes requests at a constant rate.

---

Workflow

Incoming Requests

↓

Bucket

↓

Constant Output Rate

↓

Backend Service

---

Benefits

• Predictable traffic
• Prevents sudden spikes
• Smooth request processing

---

8. Which Rate Limiting Algorithm is Best?

Algorithm	Best Use Case
Fixed Window	Simple APIs
Sliding Window	Public APIs
Token Bucket	Enterprise APIs
Leaky Bucket	Constant throughput

---

Enterprise Recommendation

Token Bucket provides the best balance between burst handling and fairness for most production workloads.

---

9. How Does Rate Limiting Work Internally?

Incoming Request

↓

Identify Client

↓

Redis Lookup

↓

Counter Update

↓

Limit Exceeded?

↓

Yes → HTTP 429

↓

No → Backend

---

Internal Working

The gateway identifies the client (IP address, API key, or JWT), retrieves the request count from Redis or another distributed store, updates the counter, and decides whether to forward or reject the request.

---

10. Why is Redis Used for Rate Limiting?

Redis is commonly used because it provides:

• High performance
• Atomic operations
• Distributed counters
• Low latency
• Scalability
• Expiration support

---

Enterprise Workflow

Gateway

↓

Redis

↓

Request Counter

↓

Allow / Reject

---

11. How is Rate Limiting Configured in Spring Cloud Gateway?

Spring Cloud Gateway provides a Redis-based rate limiter.

---

Example

filters:
  - name: RequestRateLimiter
    args:
      redis-rate-limiter.replenishRate: 10
      redis-rate-limiter.burstCapacity: 20

---

Parameters

• replenishRate
• burstCapacity
• keyResolver

---

12. How is Rate Limiting Used in Enterprise Projects?

Mobile

Web

Partner APIs

↓

Gateway

↓

Authentication

↓

Redis Rate Limiter

↓

Backend Services

---

Enterprise Benefits

• API protection
• Subscription plans
• Fair resource allocation
• Reduced infrastructure costs

---

13. What are Common Rate Limiting Challenges?

• Distributed counters
• Multiple gateway instances
• Clock synchronization
• Redis failures
• Bursty traffic
• Dynamic client limits
• Global rate limiting

---

Best Practice

Use Redis Cluster or another distributed datastore to maintain consistent counters across gateway instances.

---

14. What are Common Rate Limiting Mistakes?

• Applying one limit to every client
• Ignoring burst traffic
• Missing monitoring
• No HTTP 429 handling
• Using local memory counters
• Weak client identification
• Ignoring premium customers
• No retry guidance
• Poor logging
• Missing distributed storage

---

15. What are Rate Limiting Best Practices?

• Use Redis for distributed counters.
• Return HTTP 429 for exceeded limits.
• Configure meaningful retry intervals.
• Apply different limits for different user tiers.
• Support burst traffic using Token Bucket.
• Monitor rejected requests.
• Log abuse attempts.
• Protect login APIs with stricter limits.
• Combine rate limiting with authentication.
• Test rate limiting under production workloads.

---

Spring Cloud Gateway Example

Route Configuration

spring:
  cloud:
    gateway:
      routes:
        - id: employee-service
          uri: lb://EMPLOYEE-SERVICE
          predicates:
            - Path=/employees/**
          filters:
            - name: RequestRateLimiter
              args:
                redis-rate-limiter.replenishRate: 5
                redis-rate-limiter.burstCapacity: 10

---

Redis Configuration

@Bean
KeyResolver userKeyResolver() {
    return exchange ->
        Mono.just(exchange.getRequest()
            .getRemoteAddress()
            .getAddress()
            .getHostAddress());
}

---

Rate Limiting Summary

Concept	Description
Rate Limiting	Restricts request count
Throttling	Slows request processing
Fixed Window	Counter resets after interval
Sliding Window	Rolling time interval
Token Bucket	Token-based burst control
Leaky Bucket	Constant request processing rate
Redis	Distributed request counters
HTTP 429	Too Many Requests
RequestRateLimiter	Spring Cloud Gateway filter
API Protection	Prevents abuse and overload

---

Interview Tips

When answering API Gateway Rate Limiting interview questions:

1. Explain why rate limiting is essential for public APIs.
2. Differentiate Rate Limiting and Throttling.
3. Compare Fixed Window, Sliding Window, Token Bucket, and Leaky Bucket algorithms.
4. Explain why Token Bucket is preferred for enterprise APIs.
5. Discuss Redis as the distributed storage for request counters.
6. Explain Spring Cloud Gateway's RequestRateLimiter filter.
7. Describe HTTP 429 responses and retry strategies.
8. Explain per-user, per-IP, and per-API-key limits.
9. Discuss monitoring rejected requests using Prometheus, Grafana, and OpenTelemetry.
10. Use enterprise examples involving subscription tiers, partner APIs, and DDoS protection.

---

Key Takeaways

• Rate Limiting protects APIs by restricting the number of requests clients can make within a defined time period.
• API Gateways enforce rate limits before requests reach backend services, improving scalability and availability.
• Fixed Window, Sliding Window, Token Bucket, and Leaky Bucket are the most common rate limiting algorithms, each with different trade-offs.
• Token Bucket is widely adopted because it efficiently handles burst traffic while maintaining fair resource usage.
• Redis is the preferred distributed datastore for maintaining request counters across multiple gateway instances.
• Spring Cloud Gateway provides built-in Redis-based rate limiting through the RequestRateLimiter filter.
• HTTP 429 (Too Many Requests) is the standard response when clients exceed configured limits.
• Enterprise systems often implement different rate limits based on user roles, subscription plans, API keys, or client applications.
• Monitoring rejected requests, Redis health, and gateway latency is essential for production environments.
• Mastering API Gateway Rate Limiting is essential for Java, Spring Boot, Microservices, Cloud, DevOps, Solution Architect, and System Design interviews.