laravel:rate-limiting

Laravel rate limiting per user is configured using the RateLimiter facade and throttle middleware to define per-minute request caps, resolving authenticated users by ID and falling back to IP address when unavailable.

When a throttle rate limit is exceeded, Laravel returns standard rate limiting headers and a 429 response that includes a retry-after hint to guide clients on when to safely resend requests.

You can separate bursty endpoints by defining specialized named limiters within Laravel's RateLimiter configuration, applying custom per-minute thresholds to specific routes via the throttle middleware.

Preventing API abuse while maintaining predictable UX is achieved by applying Laravel's throttle middleware to enforce per-user and per-route request limits, returning informative 429 responses for controlled traffic.

Laravel rate limiting handles unauthenticated API requests by falling back to the client's IP address to identify and track traffic, ensuring limits still apply when user authentication is absent.