API rate limiting is a control that limits how many requests a client can send to an application programming interface in a given time window. Limits may be set per IP address, account, token, device, or endpoint, and they can be fixed, sliding, or adaptive. The goal is to keep services stable, prevent abuse, and make automated abuse more expensive.
In cyber security, rate limiting helps defend against brute-force logins, credential stuffing, scraping, denial-of-service traffic, and AI output harvesting. Without it, an attacker can send large numbers of prompts or queries to extract data, test stolen credentials, or probe a system for weaknesses. In AI settings, strong rate limits can slow model distillation abuse by making repeated, high-volume querying harder to hide or scale. Defenders often pair rate limiting with anomaly detection, request quotas, CAPTCHA challenges, and abuse review to distinguish normal application use from coordinated extraction attempts.