Glossary
Rate Limiting
Rate limiting is a technique that restricts how many requests or messages a client (user, application, or IP address) can send within a defined time window, protecting systems from overload and abuse.
General definition
Rate limiting sits at the boundary between a client and a server (or between services). When a client exceeds its allowed quota, the server responds with an HTTP 429 Too Many Requests status (for REST APIs) or an equivalent rejection, and typically includes a Retry-After header telling the client when it may try again.
- Fixed window: a counter resets at the start of each time window (e.g. 100 requests per minute)
- Sliding window: the window moves with time, smoothing out burst spikes at window boundaries
- Token bucket: clients accumulate credits at a steady rate and spend one per request, allowing controlled bursts
- Leaky bucket: requests queue and drain at a fixed rate, enforcing a strict output rate
In chat and messaging systems, rate limiting applies at multiple layers: per-user message send rate (preventing spam), per-IP connection rate (preventing floods), per-app API call rate (preventing runaway integrations), and per-channel publish rate (preventing a single room from drowning others). It is distinct from idempotency, which handles duplicate requests, not excessive ones.
Well-implemented rate limiters communicate limits clearly through response headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset) so clients can adapt without guessing.
In the Ethora ecosystem
Ethora’s platform applies rate limiting at the API and messaging layers to protect shared infrastructure and maintain consistent performance for all tenants. Message send rates, attachment uploads and bot message bursts are all subject to configurable limits.
On self-hosted and dedicated deployments, operators have direct access to the underlying configuration and can tune limits to match their traffic profile. This is particularly useful for high-volume healthcare alert systems or financial-services notification platforms that have known, predictable burst patterns outside typical consumer norms.
