laravel:rate-limiting

Enforce per-user and per-route rate limits on Laravel API endpoints.

Updated Mar 30, 2026

Search Tags:#laravel #api-security #rate-limiting #headers #throttle #retry-after

Ready to run

npx skills add https://github.com/Patkik/Multi-tenant-SaaS-Catering-V2 --skill laravel-rate-limiting-patkik

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: laravel:rate-limiting
Source: https://github.com/Patkik/Multi-tenant-SaaS-Catering-V2/tree/main/.agents/skills/rate-limiting-and-throttle
Command: npx skills add https://github.com/Patkik/Multi-tenant-SaaS-Catering-V2 --skill laravel-rate-limiting-patkik

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Protect endpoints from abuse while keeping UX predictable.

Core Features & Use Cases

Per-user and per-route rate limiting using Laravel RateLimiter and throttle middleware
Communicate limits to clients via standard headers
Provide 429 responses with retry hints
Separate bursty endpoints into specialized limiters

Quick Start

Configure the RateLimiter for 'api' to cap requests per user by ID or IP and apply the throttle middleware to API routes.

Frequently Asked Questions about laravel:rate-limiting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I configure Laravel rate limiting per user for API routes?▼

Laravel rate limiting per user is configured using the RateLimiter facade and throttle middleware to define per-minute request caps, resolving authenticated users by ID and falling back to IP address when unavailable.

What headers does Laravel return when a throttle rate limit is exceeded?▼

When a throttle rate limit is exceeded, Laravel returns standard rate limiting headers and a 429 response that includes a retry-after hint to guide clients on when to safely resend requests.

Can I set different rate limits for specific bursty endpoints in Laravel?▼

You can separate bursty endpoints by defining specialized named limiters within Laravel's RateLimiter configuration, applying custom per-minute thresholds to specific routes via the throttle middleware.

What is the best way to prevent API abuse in Laravel without degrading user experience?▼

Preventing API abuse while maintaining predictable UX is achieved by applying Laravel's throttle middleware to enforce per-user and per-route request limits, returning informative 429 responses for controlled traffic.

Does Laravel rate limiting work for unauthenticated API requests?▼

Laravel rate limiting handles unauthenticated API requests by falling back to the client's IP address to identify and track traffic, ensuring limits still apply when user authentication is absent.