Rate Limiting
As an API gateway, APISIX serves as a unified entry point for a massive volume of requests that could include both legitimate and unwanted traffic.
Rate limiting is one of the commonly used techniques to protect and manage APIs. For example, you can configure your API endpoints to allow for a set number of requests within a given period of time. This ensures fair usage of the upstream services and safeguards the APIs from potential cyber attacks like DDoS (Distributed Denial of Service) or excessive requests from web crawlers.

In this tutorial, you will enable the limit-count
plugin to set a rate limiting constraint on the incoming traffic.
Prerequisite(s)
- Complete the Get APISIX step to install APISIX first.
- Complete the Configure Routes step.
Enable Rate Limiting
The following route getting-started-ip
is inherited from Configure Routes. You only need to use the PATCH
method to add the limit-count
plugin to the route:
curl -i "http://127.0.0.1:9180/apisix/admin/routes/getting-started-ip" -X PATCH -d '
{
"plugins": {
"limit-count": {
"count": 2,
"time_window": 10,
"rejected_code": 429
}
}
}'
You will receive an HTTP/1.1 200 OK
response if the plugin was added successfully. The above configuration limits the incoming requests to a maximum of 2 requests within 10 seconds.
Validate
Generate 50 simultaneous requests to see the rate limiting plugin in effect.
resp=$(seq 50 | xargs -I{} curl "http://127.0.0.1:9080/ip" -o /dev/null -s -w "%{http_code}\n") && \
count_200=$(echo "$resp" | grep "200" | wc -l) && \
count_429=$(echo "$resp" | grep "429" | wc -l) && \
echo "200": $count_200, "429": $count_429
The results are as expected: out of the 50 requests, 2 requests were sent successfully (status code 200
) while the others were rejected (status code 429
).
"200": 2, "429": 48
Disable Rate Limiting
Disable rate limiting by setting the _meta.disable
parameter to true
:
curl -i "http://127.0.0.1:9180/apisix/admin/routes/getting-started-ip" -X PATCH -d '
{
"plugins": {
"limit-count": {
"_meta": {
"disable": true
}
}
}
}'
Validate
Generate 50 requests again to validate if it is disabled:
resp=$(seq 50 | xargs -I{} curl "http://127.0.0.1:9080/ip" -o /dev/null -s -w "%{http_code}\n") && \
count_200=$(echo "$resp" | grep "200" | wc -l) && \
count_429=$(echo "$resp" | grep "429" | wc -l) && \
echo "200": $count_200, "429": $count_429
The results below show that all of the requests were sent successfully:
"200": 50, "429": 0
More
You can use APISIX variables to configure fined matching rules of rate limiting, such as $host
and $uri
. In addition, APISIX also supports rate limiting at the cluster level using Redis.
What's Next
Congratulations! You have learned how to configure rate limiting and completed the Getting Started tutorials.
You can continue to explore other documentations to customize APISIX and meet your production needs.