Work out rate limit threshold instantly with clear inputs, formula shown and shareable results.
A rate limit should sit above the p99 of genuine per-user behaviour so real users never hit it, typically at two to five times that figure. The check that is usually skipped is aggregate: if every active user ran at the cap simultaneously, the backend must still survive. When it cannot, the per-user limit is decoration and a global concurrency limit is also required.
Rate limit sizing
per-user limit = p99 per minute x safety multiplier; worst-case backend load = users x limit / 60
Both. Per-user limits stop credential-based abuse; per-IP limits catch unauthenticated traffic, though NAT and carrier-grade NAT mean per-IP limits must be more generous.
A token bucket allows short bursts while capping the sustained rate, which matches real client behaviour far better than a fixed window that resets abruptly.