Rate Limiting Checklist for Public APIs

A production-ready checklist for login, signup, API, and webhook rate limiting to reduce abuse and outages.

Where to enforce limits

Apply strict limits on login, signup, password reset, and token issuance routes.
Add route-level policies for heavy or expensive API endpoints.
Differentiate burst vs sustained limits and return clear retry headers.
Use stronger limits for anonymous traffic than authenticated traffic.
Protect webhook endpoints even if they also use signatures.

Store counters in a shared backend (Redis or managed equivalent) so limits remain correct across instances and regions.

Vibio identifies missing or weak rate limiting signals and groups findings into fast, ordered Fix Packs.