X-RateLimit-Limit

General Summary

Indicates the maximum number of requests allowed in the current rate limit window.

RateLimit-Limit Standardized version of this header without X- prefix

Detailed Description

The X-RateLimit-Limit response header specifies the total number of requests a client is permitted to make within a given time window before being rate limited. This header is part of a common pattern used by APIs to communicate rate limiting policies to clients. It works in conjunction with other rate limit headers like X-RateLimit-Remaining and X-RateLimit-Reset to provide complete visibility into the client’s quota status.

Use Cases (When, Why, and How)

When to Use It

Servers should include this header in responses to API requests where rate limiting is enforced, particularly for public APIs, authenticated endpoints, or any service that needs to prevent abuse or ensure fair resource allocation.

Why to Use It

Rate limiting protects servers from being overwhelmed by excessive requests, whether from misconfigured clients, aggressive scrapers, or malicious actors. By exposing the limit through this header, clients can proactively manage their request patterns, implement backoff strategies, and avoid hitting rate limits that would result in 429 Too Many Requests errors.

How to Use It

The server sets this header to a numeric value representing the maximum allowed requests. Clients should read this value to understand their quota and adjust their behavior accordingly.

Example code in Javascript:

fetch('https://api.example.com/data')
  .then(response => {
    const limit = response.headers.get('X-RateLimit-Limit');
    const remaining = response.headers.get('X-RateLimit-Remaining');
    console.log(`Rate limit: ${remaining}/${limit} requests remaining`);
    return response.json();
  });

Example

X-RateLimit-Limit: 1000