What is HTTP 429 – Too Many Requests?

HTTP 429 means the client has sent too many requests in a given amount of time (rate limiting). Laravel triggers this when requests exceed configured limits — typically to protect your app from abuse or overloading.

---

Common Scenarios Causing 429 in Laravel

• Multiple users behind the same IP (e.g., via NAT, load balancer, or Docker)
• API calls from microservices hitting Laravel endpoints
• Performance testing or bots
• Poorly configured throttle middleware
• Mobile or IoT apps making rapid requests

---

Laravel Rate Limiting Basics

Laravel uses the ThrottleRequests middleware:

Route::middleware('throttle:60,1')->group(function () {
    Route::get('/api/data', 'DataController@index');
});

This allows 60 requests per minute per user/IP.

---

Solutions to Fix or Improve Rate Limiting

1. Increase Rate Limit Per Route

Route::middleware('throttle:300,1')->get('/api/resource', 'ResourceController@index');

Allows 300 requests per minute

---

2. Define Custom Rate Limiters (Laravel 8+)

In RouteServiceProvider.php:

use Illuminate\Support\Facades\RateLimiter;
use Illuminate\Cache\RateLimiting\Limit;

RateLimiter::for('custom-api', function ($request) {
    return Limit::perMinute(200)->by(optional($request->user())->id ?: $request->ip());
});

Then use:

Route::middleware('throttle:custom-api')->group(...);

---

3. Throttle Based on User ID (Not IP)

Limit::perMinute(300)->by($request->user()?->id ?: $request->ip());

This prevents shared IPs (like containers or offices) from hitting the global rate limit.

---

4. Disable Rate Limiting for Internal IPs

RateLimiter::for('api', function ($request) {
    if (in_array($request->ip(), ['127.0.0.1', '172.20.0.2'])) {
        return Limit::none();
    }
    return Limit::perMinute(60);
});

---

5. Handle 429 Gracefully in Frontend/Microservices

Add retry logic:

if (response.status === 429) {
    const retryAfter = response.headers['retry-after'] || 1;
    await new Promise(r => setTimeout(r, retryAfter * 1000));
    retryRequest();
}

---

6. Use Laravel Job Queues for Heavy APIs

Offload rate-heavy tasks to queues:

dispatch(new ProcessWebhook($data));

Avoid synchronous spikes by spreading processing.

---

7. Track and Log 429 Errors

Use global exception handler:

public function render($request, Throwable $exception)
{
    if ($exception instanceof ThrottleRequestsException) {
        Log::warning('Rate limit exceeded', [
            'ip' => $request->ip(),
            'url' => $request->url(),
        ]);
    }
    return parent::render($request, $exception);
}

---

8. Use Redis for Smarter Limiting

Laravel supports Redis-backed rate limits:

'limiter' => env('CACHE_DRIVER', 'redis'),

Redis allows burst handling and high-speed checks.

---

9. Use API Gateway or Reverse Proxy Rate Limiting

If using services like:

• NGINX: limit_req_zone, limit_req
• AWS API Gateway: rate/usage plans
• Cloudflare: Rate Limiting Rules

Apply rate limits before Laravel even sees the request.

---

10. Implement Client Token Quotas

Track usage per API token/user key:

• Use Laravel Passport or Sanctum
• Store request counts in Redis/DB

---

Microservices Specific Tips

Problem	Solution
Burst API requests	Queue or cache throttle
Services on same IP	Use unique user tokens per service
Stateless retry loops	Add jitter or exponential backoff
API aggregator overload	Add inter-service caching

---

Inspect Rate Limit Headers

Laravel adds these headers:

• X-RateLimit-Limit
• X-RateLimit-Remaining
• Retry-After

Log or inspect them to tune performance or debug issues.

---

Summary

Solution	Use Case
throttle:200,1	General increase
Custom limiter	User-based, IP-based
Disable for internal IPs	Microservices, local traffic
Queuing heavy jobs	Async deferral
Redis backend	Fast & scalable
Gateway limits	Layer 7 protection

---

Final Thoughts

429 errors protect your app — but when wrongly configured, they block real users and services. Laravel gives you the tools to fine-tune rate limits by IP, user, or context. For microservices, coordination is key: throttle at the API gateway and queue jobs internally.

Let me know if you want examples with Laravel Sanctum, Redis-backed rate limits, or job queue implementations!