HTTP 429 Too Many Requests

Client: honour Retry-After, otherwise back off with jitter

Retry-After is either a number of seconds or an HTTP date. Without it, use exponential backoff with random jitter so many clients don't retry in lockstep, and cap the retries.

async function fetchWithRetry(url, options = {}, maxRetries = 5) {
  for (let attempt = 0; ; attempt++) {
    const res = await fetch(url, options);
    if (res.status !== 429 || attempt === maxRetries) return res;

    const header = res.headers.get('Retry-After');
    let delay;
    if (header && !Number.isNaN(Number(header))) {
      delay = Number(header) * 1000;                           // seconds
    } else if (header) {
      delay = Math.max(0, Date.parse(header) - Date.now()) || 1000; // HTTP date
    } else {
      delay = Math.random() * Math.min(30_000, 500 * 2 ** attempt); // full jitter
    }
    await new Promise((resolve) => setTimeout(resolve, delay));
  }
}

nginx: limit_req returns 503 unless you change it

limit_req_status defaults to 503, which tells clients and crawlers the server is down. Set it to 429.

http {
    limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;

    server {
        location /api/ {
            limit_req zone=api burst=20 nodelay;
            limit_req_status 429;   # default is 503
            proxy_pass http://127.0.0.1:3000;
        }
    }
}

Express: express-rate-limit

It responds 429 with Retry-After and the standard RateLimit headers. Behind a proxy, set trust proxy or every client shares the proxy's IP.

import { rateLimit } from 'express-rate-limit';

app.set('trust proxy', 1);
app.use('/api/', rateLimit({
  windowMs: 60 * 1000,        // 1 minute
  limit: 100,                 // requests per IP per window
  standardHeaders: 'draft-7', // RateLimit + RateLimit-Policy headers
  legacyHeaders: false,
}));

Limit concurrency instead of firing everything at once

Process work in small batches or with a concurrency limiter such as p-limit, so you stay under the limit in the first place.