Backend & systems·API and interface design
you cap each client at a hundred requests a minute and start returning 429 once they go over.
Rate limiting
Also calledthrottling, quota
Bounding how much a given caller can consume in a time window. It protects capacity, contains abuse, and stops one tenant from degrading everyone else. The limit needs to be per-identity and communicated in headers, or well-behaved clients cannot back off correctly and will simply retry into the wall.