HTTP 429 Too Many Requests

HTTP 429 Too Many Requests — The client sent too many requests in a given time (rate limiting).

Class

4xx Client Error

Defined in

RFC 6585

Official

Yes (IANA registry)

Cacheable by default

No (unless Cache-Control/Expires say so)

Safe to retry

Yes, after a delay (respect Retry-After)

What does HTTP 429 mean?

429 Too Many Requests means the client has sent too many requests in a given amount of time — it's hit a rate limit. The response may include a Retry-After header saying how many seconds to wait (or until what date).

Defined in RFC 6585, it's used by virtually every public API (GitHub, OpenAI, Stripe, Twitter/X) and by CDNs and WAFs to protect against abuse, scraping and accidental request floods.

When is 429 used?

• An API client exceeds its quota per second, minute or day.
• Login endpoints throttle repeated attempts.
• A CDN/WAF rate-limiting rule detects a burst from one IP.
• A frontend bug fires requests in a loop (e.g. a useEffect without dependencies).

Common causes of a 429

• Too many requests from your IP, API key or account in a short window.
• Shared IPs (offices, VPNs, mobile carriers' NAT) pooling many users into one limit.
• Retries without backoff that amplify the problem.

How to fix 429 Too Many Requests

If you're visiting the site

1. Wait a minute or two and try again — the limit resets automatically.
2. Stop refreshing repeatedly; each refresh counts.
3. Turn off your VPN, since many users may share its IP.

If you run the site or API (developers)

1. Respect Retry-After, and use exponential backoff with jitter for retries.
2. Read rate-limit headers (RateLimit-*, X-RateLimit-Remaining) and slow down before hitting zero.
3. Cache responses and batch requests to reduce volume.
4. When implementing limits, return 429 with Retry-After and a clear body — not 403 or 503.

Returning or handling 429: server examples

http {
    limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
    server {
        location /api/ {
            limit_req zone=api burst=20 nodelay;
            limit_req_status 429;   # default is 503!
            proxy_pass http://app;
        }
    }
}

import rateLimit from "express-rate-limit";

app.use("/api/", rateLimit({
  windowMs: 60_000,
  limit: 100,                 // 100 requests per minute per IP
  standardHeaders: "draft-7", // RateLimit headers; 429 + Retry-After when exceeded
}));

async function fetchWithRetry(url, tries = 5) {
  for (let i = 0; ; i++) {
    const res = await fetch(url);
    if (res.status !== 429 || i === tries - 1) return res;
    const wait = Number(res.headers.get("Retry-After")) * 1000 || 2 ** i * 1000 + Math.random() * 250;
    await new Promise((r) => setTimeout(r, wait));
  }
}

Example 429 response

HTTP/1.1 429 Too Many Requests
Retry-After: 30
RateLimit-Policy: 100;w=60
RateLimit: limit=100, remaining=0, reset=30
Content-Type: application/json

{"error":"rate_limited","message":"Too many requests, retry in 30 seconds."}

Related status codes

• 503 Service UnavailableThe server is temporarily unable to handle the request (overload or maintenance).
• 403 ForbiddenThe server understood the request but refuses to authorize it.
• 431 Request Header Fields Too LargeThe server refuses the request because a header — or all headers together — is too large.

Related tools

• HTTP status codes — full list
• HTTP headers reference
• cURL converter
• Mock API — fake REST endpoints with custom status codes
• Webhook tester — inspect incoming requests