Protect endpoints from abuse while keeping UX predictable.
Commands
// App\Providers\RouteServiceProvider
RateLimiter::for('api', function (Request $request) {
return Limit::perMinute(60)->by(optional($request->user())->id ?: $request->ip());
});
// routes/api.php
Route::middleware(['throttle:api'])->group(function () {
// ...
});
Patterns
-
Scope limits by user when authenticated; fall back to IP
-
Communicate limits to clients via standard headers
-
Provide sensible 429 responses with retry hints
-
Separate bursty endpoints into specialized limiters