Laravel Rate Limiting

When to use

• The user needs per-user, per-IP, or dynamic per-plan rate limits defined with the RateLimiter facade.
• The user is choosing a rate-limit store (Redis vs the default cache) or debugging 429 responses and Retry-After headers.
• The user wants to throttle requests to a route or API with the throttle middleware or a named limiter.

When NOT to use

• Do not use rate limiting to authenticate or authorize callers; use auth guards and policies for identity, and rate limiting only to cap request volume.
• Do not use HTTP throttle middleware to pace queued jobs against a rate-limited API; use queue rate-limiting middleware such as RateLimited on the job instead.

Core guidance