#api-protection

Protect APIs with rate limiting. Strategies: 1. Fixed window (requests per minute). 2. Sliding window for smoother limits. 3. Token bucket for burst handling. 4. Leaky bucket for consistent rate. 5. Per-user vs global limits. 6. Redis for distributed rate limiting. 7. Return 429 with Retry-After header. 8. Different tiers for API keys. Use middleware like express-rate-limit. Implement exponential backoff guidance.