Rate limiting is a rule that caps how often you can ask a service for something. It might say "60 requests per minute" or "100,000 tokens per minute". Go over the line and the service slows you down, returns an error, or blocks you for a while.
Why services use it
There are three main reasons.
- Protection from overload. A flood of requests can crash a service for everyone. Limits keep one user from using more than a fair share.
- Abuse prevention. Bots that scrape pages, guess passwords or spam forms act far faster than people. A pace that no human would reach is a strong signal that something automated is running.
- Cost control. Every AI request uses expensive GPU time. Limits keep a bill, or a provider's capacity, from running away.
Limits on AI APIs
AI providers usually set limits in more than one unit: requests per minute, tokens per minute, and sometimes tokens per day. Your limit often rises as you spend more or use the service longer. If you hit it, the API typically returns an error code, and your code should wait and retry with growing delays instead of hammering the service. An AI gateway can queue requests or fall back to another provider when one is limited.
Limits also tie to your API key. A leaked key is dangerous partly because it spends your quota and your money.
Websites apply the same idea to visitors. Social platforms and online stores watch the pace of actions on an account. A browser agent that reads pages or clicks far faster than a person can look like a bot, and the platform may slow it, ask for verification, or suspend the account. Many sites also set rules for web crawlers, and a file called robots.txt states them, though it only works if the crawler follows it.
What to do about it
If you build with AI, plan for limits from the start. Add retries with backoff, spread work over time, and watch your usage. If you run an agent inside accounts you care about, slow it to a human-like pace, use an official API where one exists, and keep a separate account for heavy reading. Treat a rate limit as a boundary the service has set, not a bug to route around.