429 Too Many Requests

What HTTP 429 Too Many Requests Means

The user has sent too many requests in a given amount of time.

Rate limit exceeded.

Common Causes

• API rate limit exceeded
• Too many login attempts
• DDoS protection triggered
• Scraping detected

How to Fix It (For Visitors)

• Wait before retrying
• Slow down request rate
• Try again later

How to Fix It (For Developers/Admins)

• Implement exponential backoff
• Check Retry-After header
• Reduce request frequency
• Cache responses
• Use request queuing

Handling 429 With Retry-After and Backoff

Servers often include a Retry-After header with either a number of seconds or an HTTP date. Respect it, and otherwise back off exponentially with some random jitter:

async function fetchWithRetry(url, tries = 5) {
  for (let i = 0; i < tries; i++) {
    const res = await fetch(url);
    if (res.status !== 429) return res;
    const wait = Number(res.headers.get('Retry-After')) || 2 ** i;
    await new Promise(r => setTimeout(r, wait * 1000 + Math.random() * 250));
  }
  throw new Error('Rate limited');
}

Rate Limiting in nginx

nginx's limit_req module answers with 503 by default when a client exceeds the limit. Add limit_req_status 429; so clients receive the more accurate 429 code.

Returning a 429 Too Many Requests (Code Examples)

If you build APIs or web apps, here is how to send an HTTP 429 response and how to test for it:

Node.js (Express)

app.get('/resource', (req, res) => {
  res.status(429).json({ error: 'Too Many Requests' });
});

Python (Flask)

@app.route('/resource')
def resource():
    return jsonify(error='Too Many Requests'), 429

PHP

<?php
http_response_code(429);
header('Content-Type: application/json');
echo json_encode(['error' => 'Too Many Requests']);

Check the status with curl

curl -I https://example.com/resource
# Look for: HTTP/1.1 429 Too Many Requests

Frequently Asked Questions

What does HTTP 429 Too Many Requests mean?

Rate limit exceeded. In short: The user has sent too many requests in a given amount of time.

Is 429 Too Many Requests a client or server error?

429 is a 4xx client-error code, so the request itself needs to change. The server is running normally and is rejecting the request as it was sent by the browser, app, or API client.

How do I fix a 429 Too Many Requests error?

Implement exponential backoff. Check Retry-After header. Reduce request frequency.

Official Specification

The 429 Too Many Requests status code is defined in RFC 6585.

View the IANA HTTP Status Code Registry →