# HTTP 429 Too Many Requests — Meaning, Causes & Fixes

> The client sent too many requests in a given amount of time — it's being rate limited.

429 is rate limiting. The server — or an API gateway or CDN in front of it — counted your requests, and you went over the allowance. A well-behaved server includes `Retry-After` (seconds to wait, or a date), often alongside headers that show the quota. A well-behaved client waits that long before trying again instead of hammering the server.

- Class: 4xx Client Error
- Retry: With backoff (idempotent requests only)
- Cacheable by default: no
- Defined in: [RFC 6585 §4 — 429 Too Many Requests](https://www.rfc-editor.org/rfc/rfc6585#section-4)

## Example response

```http
HTTP/1.1 429 Too Many Requests
Retry-After: 60
Content-Type: application/json
Content-Length: 29

{"error":"Too Many Requests"}
```

## Common causes

- Exceeding an API's per-second, per-minute or daily quota.
- Many parallel requests from one IP address or API key.
- Retry loops without backoff, which turn one failure into hundreds of requests.
- Shared IPs — offices, CI runners, cloud NAT — pooling everyone's traffic into one limit.

## How to fix it

1. Honour `Retry-After`. Without it, back off exponentially with jitter: about 1 s, 2 s, 4 s, plus a random offset.
2. Cache responses and batch requests to cut volume.
3. Smooth bursts out with a queue.
4. If you legitimately need more, ask for a higher quota or a dedicated key.

## Send a 429 from your server

### Express

```
res.set("Retry-After", "60");
res.status(429).json({ error: "Too Many Requests" });
```

### Next.js route handler

```
return Response.json({ error: "Too Many Requests" }, { status: 429, headers: { "Retry-After": "60" } });
```

### Flask

```
return {"error": "Too Many Requests"}, 429, {"Retry-After": "60"}
```

### Go net/http

```
w.Header().Set("Retry-After", "60")
http.Error(w, "Too Many Requests", http.StatusTooManyRequests)
```

### nginx

```
add_header Retry-After "60" always;
return 429;
```

## FAQ

### How long should I wait after a 429?

Exactly as long as Retry-After says. Without it, use exponential backoff with jitter and cap the number of retries.

### 429 vs 503?

429 is about you: this client exceeded its limit. 503 is about the server: it's overloaded or down for everyone. Both may carry Retry-After.

### How do I rate limit my own API?

In nginx, use limit_req_zone and limit_req; in Express, middleware such as express-rate-limit. Respond with 429 and Retry-After so clients can recover.

## Related status codes

- [503 Service Unavailable](https://www.devkult.com/http/503.md)
- [403 Forbidden](https://www.devkult.com/http/403.md)
- [402 Payment Required](https://www.devkult.com/http/402.md)

Open the interactive page: https://www.devkult.com/http/429