API Design · Middle · Question 36 of 75

Why should rate limits be applied per client (API key or user) rather than only per IP?

1IP addresses can't be read by servers
2Per-IP limits are illegal
✓Correct answer: Many users can share one IP (NAT, mobile carriers), and attackers can rotate IPs; per-client limits are fairer and harder to bypass

Explanation

Combine both: per-IP limits for anonymous traffic, per-key or per-user limits for authenticated calls.

Further reading

Test yourself

Take the API Design · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.