429 Too Many Requests

The client has sent too many requests in a given time window. The server is asking it to slow down. Common at API endpoints, CDN edges, and WAFs.

What It Means

429 Too Many Requests is a rate-limiting response. The server has detected that the client is sending requests faster than the allowed rate and is refusing further requests until the rate drops. The error is on the client side in the sense that the client is sending too fast, but it is not a permanent failure — the client should back off and retry.

The server may include a Retry-After header indicating when the client may safely retry. The value is either a number of seconds to wait, or an HTTP-date after which requests are again permitted.

HTTP/1.1 429 Too Many Requests
Retry-After: 30

When It Occurs

• API rate limits. REST APIs enforce per-key or per-IP request quotas (e.g., 1000 requests per minute). Exceeding the quota triggers 429.
• CDN and WAF rules. Edge providers like Cloudflare block traffic bursts that exceed configured thresholds to protect origins.
• Login and authentication endpoints. Servers throttle repeated login attempts to slow credential-stuffing attacks.
• Aggressive scrapers or crawlers. Bots that request pages faster than the server's crawler budget triggers rate limiting.

Common Issues

• Ignoring Retry-After. Clients that immediately retry on 429 make the problem worse and may trigger longer bans. Always honor Retry-After if present.
• Missing exponential backoff. Clients should not retry at a fixed interval. Use exponential backoff with jitter: double the wait time on each successive 429, plus a small random offset to avoid thundering-herd effects.
• Shared IP rate limits. Behind a NAT or corporate proxy, multiple users share one IP. One user's burst can trigger 429 for everyone sharing that IP.

How to Diagnose

Use the Probe tool to check response headers including Retry-After, X-RateLimit-Limit, and X-RateLimit-Remaining (non-standard but widely used). If you are seeing 429 on your own infrastructure, review your rate-limit configuration and check whether the rate is appropriate for legitimate traffic patterns.