Abuse was hammering our client's API—thousands of requests per minute from a handful of IPs. We added rate limiting: 100 requests per minute per IP. Problem solved. New problem created.

What Broke

A corporate client with 200 employees behind a single NAT gateway hit the limit by 10 AM every day. Legitimate users got 429 errors. Support tickets flooded in.

The Fix

We switched from IP-based to token-based rate limiting for authenticated requests. Anonymous/public endpoints kept IP limits but with a higher threshold. We also added a sliding window instead of a hard reset every minute.

Better Architecture

• Authenticated users: rate limit by API key or user ID
• Anonymous users: rate limit by IP with generous limits
• Known bad actors: block list with manual review

Rate limiting protects your API. Just make sure you're limiting the right thing.