# API Rate Limiting Deep Dive {#api-rate-limiting-deep-dive}


Protect your API from abuse with rate limiting.


## Configuration {#configuration}


```env
THROTTLE_TTL=60
THROTTLE_LIMIT=100
```

This allows 100 requests per 60 seconds per IP.


## Per-Endpoint Limits {#per-endpoint-limits}


```typescript
@Throttle({ default: { limit: 5, ttl: 60 } })
@Post('auth/login')
async login(@Body() dto: LoginDTO) {}

@Throttle({ default: { limit: 1000, ttl: 60 } })
@Get('employee')
async findAll() {}
```


## Rate Limit Headers {#rate-limit-headers}


| Header                  | Description               |
| ----------------------- | ------------------------- |
| `X-RateLimit-Limit`     | Max requests per window   |
| `X-RateLimit-Remaining` | Remaining requests        |
| `X-RateLimit-Reset`     | Window reset timestamp    |
| `Retry-After`           | Seconds until retry (429) |


## Response on Rate Limit {#response-on-rate-limit}


```json
{
  "statusCode": 429,
  "message": "ThrottlerException: Too Many Requests"
}
```


## Redis-Based Rate Limiting {#redis-based-rate-limiting}


For multi-instance deployments, use Redis storage:

```typescript
ThrottlerModule.forRoot({
  throttlers: [{ ttl: 60, limit: 100 }],
  storage: new ThrottlerStorageRedisService(redisClient),
});
```


## Recommended Limits {#recommended-limits}


| Endpoint Type  | Limit         | Window |
| -------------- | ------------- | ------ |
| Login          | 5 attempts    | 60s    |
| Password Reset | 3 attempts    | 300s   |
| CRUD Read      | 1000 requests | 60s    |
| CRUD Write     | 100 requests  | 60s    |
| File Upload    | 10 uploads    | 60s    |
| Export         | 5 exports     | 300s   |


## Related Pages {#related-pages}


- [Security Overview](https://sourcey-gauzy.pages.dev/security/security-overview/index.md) — security guide
- [API Rate Limits Reference](https://sourcey-gauzy.pages.dev/reference/api-rate-limits/index.md) — limits table