API rate limiting returning 429 for legitimate requests

Medium production Laravel API
636
views
5
votes

Authenticated API requests are being rate limited at 60 requests per minute, which is too aggressive for batch operations. The X-RateLimit-Remaining header shows 0 after only 10 requests.

The default throttle configuration is applying the same limit to both authenticated and unauthenticated users.

A
Admin User
Jul 28, 2026

Solutions

1
5
A
Admin User Jul 28, 2026

Configure separate rate limits for authenticated and unauthenticated users in RouteServiceProvider.

RateLimiter::for('api', function (Request $request) {
    return $request->user()
        ? Limit::perMinute(1000)->by($request->user()->id)
        : Limit::perMinute(60)->by($request->ip());
});

Have a solution to share?

Sign in to submit a solution