API Keys and Rate Limiting

API keys are long random strings issued to clients for identifying and authenticating them. They are simpler than OAuth but provide no user context—they identify an application, not a person. API keys are suitable for server-to-server communication and public data APIs where user identity is not relevant. Rate limiting protects APIs from abuse and ensures fair usage. The standard approach is a sliding window or token bucket algorithm tracked per API key, IP, or user. Response headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, Retry-After) communicate the current limit state so clients can implement adaptive throttling.

Example

# API key in header (preferred)
GET /data/weather?city=London HTTP/1.1
X-API-Key: sk_live_abc123def456ghi789

# API key in query string (avoid — logged by servers/proxies)
GET /data/weather?city=London&api_key=sk_live_abc123def456ghi789

# Rate limit response headers
HTTP/1.1 200 OK
X-RateLimit-Limit:     1000
X-RateLimit-Remaining: 742
X-RateLimit-Reset:     1714560000
X-RateLimit-Window:    3600

# Rate limit exceeded
HTTP/1.1 429 Too Many Requests
X-RateLimit-Limit:     1000
X-RateLimit-Remaining: 0
X-RateLimit-Reset:     1714560000
Retry-After:           3542
{ "error": "RATE_LIMITED", "message": "Hourly limit of 1000 requests exceeded" }

# Laravel rate limiting (app/Http/Kernel.php + RouteServiceProvider)
// RateLimiter::for('api', function (Request $request) {
//   return [
//     Limit::perMinute(60)->by($request->user()?->id ?: $request->ip()),
//     Limit::perHour(1000)->by($request->header('X-API-Key')),
//   ];
// });
// Route::middleware(['throttle:api'])->group(function () {
//   Route::apiResource('posts', PostController::class);
// });

HTML

Full Editor

Related Resources

REST API Reference

Complete tag & property list

REST API How-To Guides

Step-by-step practical guides

REST API Exercises

Practice what you've learned