0Pricing
PHP Academy · Lesson

Rate Limiting and API Versioning

Throttle requests with RateLimiter and version your API cleanly.

Rate Limiting and API Versioning is a free PHP Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the PHP Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Rate Limit?

Rate limiting protects APIs from abuse, DoS attacks, and runaway clients. It ensures fair resource distribution among all users.

Built-in Laravel Throttle

Apply the throttle middleware to limit requests per time window.

<?php
Route::middleware("throttle:60,1")->group(function () {
    // 60 requests per 1 minute per user/IP
    Route::apiResource("posts", PostController::class);
});

Custom Rate Limiters

Define named rate limiters with custom logic in a service provider.

<?php
// In AppServiceProvider::boot():
RateLimiter::for("api", function (Request $request) {
    return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip());
});

// Apply:
Route::middleware("throttle:api")->group(fn() => ...);

Tiered Rate Limiting

Return different limits based on the authenticated user's plan.

<?php
RateLimiter::for("api", function (Request $request) {
    return match($request->user()?->plan) {
        "pro"  => Limit::perMinute(300)->by($request->user()->id),
        "free" => Limit::perMinute(60)->by($request->user()?->id ?: $request->ip()),
        default => Limit::perMinute(30)->by($request->ip()),
    };
});

Rate Limit Response Headers

When throttled, Laravel returns HTTP 429 with headers: X-RateLimit-Limit, X-RateLimit-Remaining, Retry-After.

API Versioning Strategies

Three common approaches:

  1. URL prefix: /api/v1/users
  2. Query param: /api/users?version=1
  3. Accept header: Accept: application/vnd.myapp.v1+json

URL prefix is the most common in Laravel APIs.

URL Prefix Versioning

Group routes under a version prefix.

<?php
Route::prefix("v1")->group(function () {
    Route::apiResource("users", \App\Http\Controllers\Api\V1\UserController::class);
});

Route::prefix("v2")->group(function () {
    Route::apiResource("users", \App\Http\Controllers\Api\V2\UserController::class);
});

Version-Specific Controllers

Organise controllers by version in subdirectories: App\Http\Controllers\Api\V1\ and App\Http\Controllers\Api\V2\.

Deprecating Old Versions

Add a Deprecation or Sunset header to old-version responses to notify clients of upcoming removal.

<?php
// Middleware for v1 routes:
$response->headers->set("Deprecation", "version="v1"");
$response->headers->set("Sunset", "2026-01-01");

API Resources and Versioning

Use version-specific API Resources: V1\UserResource and V2\UserResource to shape different response structures per version.

Testing Rate Limits

In tests, fake the rate limiter to avoid test interference.

<?php
RateLimiter::shouldReceive("tooManyAttempts")->andReturn(false);

Summary

Apply throttle:60,1 for basic rate limiting. Use RateLimiter::for() for custom, tiered limits. Version APIs with URL prefixes and version-specific controllers and resources.

Quick Check

What HTTP status code does Laravel return when rate limit is exceeded?

Frequently asked questions

Is the “Rate Limiting and API Versioning” lesson free?

Yes — the full text of “Rate Limiting and API Versioning” is free to read here on the web, and the PHP Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the PHP Academy course, upgrade to CoddyKit PRO.

What will I learn in “Rate Limiting and API Versioning”?

Throttle requests with RateLimiter and version your API cleanly. You practise PHP Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start PHP Academy?

No prior experience is required. PHP Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Rate Limiting and API Versioning” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this PHP Academy lesson?

Yes. Every PHP Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. API Routes and Resource Controllers
  2. API Resources and JSON Responses
  3. Authentication with Laravel Sanctum
  4. Rate Limiting and API Versioning
← Back to PHP Academy