Throttling APIs
Overview
Implement API throttling policies that protect backend services from overload by controlling request concurrency, queue depth, and processing rates. Apply backpressure mechanisms including concurrent request limits, priority queues, circuit breakers, and adaptive throttling that adjusts limits based on real-time backend health metrics.
Prerequisites
- Middleware-capable web framework (Express, FastAPI, Spring Boot, Gin)
- Redis or in-memory store for distributed throttle state tracking
- Monitoring system exposing backend latency and error rate metrics (Prometheus, CloudWatch)
- Load testing tool (k6, Artillery, wrk) for validating throttle behavior under pressure
- Queue system for request buffering during throttle events (optional: Bull, SQS)
Instructions
- Analyze existing route handlers and middleware using Grep and Read to identify endpoints with high latency, database-heavy operations, or external service dependencies that need throttle protection.
- Implement a concurrency limiter middleware that tracks in-flight requests per endpoint and rejects new requests with 503 Service Unavailable when the concurrent limit is reached.
- Add priority queue support that classifies requests by API key tier (free, pro, enterprise) and serves higher-tier requests first when approaching throttle limits.
- Build a circuit breaker for downstream service calls that opens after configurable failure thresholds (e.g., 5 failures in 10 seconds), returning 503 with
Retry-After during the open state.
- Configure adaptive throttling that monitors backend response latency percentiles (p95, p99) and automatically reduces concurrency limits when latency exceeds SLO thresholds.
- Add throttle state headers to all responses:
X-Throttle-Limit, X-Throttle-Remaining, and X-Throttle-Reset for client-side awareness.
- Implement graceful degradation strategies per endpoint: serve cached responses, return partial results, or queue requests for deferred processing.
- Write load tests that verify throttle engagement at expected thresholds, proper 503 responses with
Retry-After, and recovery behavior when load subsides.
See ${CLAUDESKILLDIR}/references/implementation.md for the full implementation guide.
Output
${CLAUDESKILLDIR}/src/middleware/throttle.js - Concurrency and request rate throttling middleware${CLAUDESKILLDIR}/src/middleware/circuit-breaker.js - Circuit breaker for downstream service protection${CLAUDESKILLDIR}/src/middleware/priority-queue.js - Tier-based request prioritization${CLAUDESKILLDIR}/src/config/throttle-config.js - Per-endpoint throttle policy definit
