A popular bar without a doorman lets everyone in at once, until the room is unusable for the customers already inside. A doorman who caps entries per minute keeps the room usable for everyone, turning away the overflow instead of letting the crowd crush the space. Rate limiting is that doorman for an API endpoint — a bounded number of requests get through per window, and the rest are turned away before they can do damage.
This site enforces it on itself: the Hire Me contact form is throttled to 5 submissions per minute and the resume download to 20, both via Laravel's built-in throttle middleware — cheap insurance against a public form or download link being hammered. The same instinct shows up on the integration side. Every payment gateway, shipping carrier, and third-party API I integrated into Magento at Infracommerce had its own ceiling on the other end; part of integrating them well was respecting that ceiling and building retries around it, rather than assuming unlimited throughput was ever on the table.
Trade-off: the same limit that blocks abuse also catches a legitimate integration partner sending a real traffic burst — a rate limit needs its own escape hatch (a higher tier, an allowlisted key) or it ends up punishing exactly the callers you want to keep.
Before
Route::post('/api/v1/login', [AuthController::class, 'login']);
class AuthController
{
public function login(Request $request): JsonResponse
{
// any client can call this as fast as it wants
return $this->attempt($request->only('email', 'password'));
}
}After
Route::post('/api/v1/login', [AuthController::class, 'login'])
->middleware('throttle:5,1');
class AuthController
{
public function login(Request $request): JsonResponse
{
// the 6th request within the window gets a 429 automatically
return $this->attempt($request->only('email', 'password'));
}
}