HTTP 429 — Too Many Requests

What 429 actually means

Rate limiting. The server is fine, the request is fine, but you have used up your allowance and it wants you to slow down. A well-implemented 429 carries a `Retry-After` header saying how long to wait, and often `X-RateLimit-*` headers describing the budget. Limits are usually applied per API key, per account or per IP address, which is why an office or a NAT-ed network can hit one collectively without any single person doing anything unusual.

Common causes

• An API client exceeding its requests-per-minute quota
• A retry loop with no backoff hammering an endpoint
• Many users behind one IP address sharing a per-IP limit
• A crawler or scraper being throttled
• Repeated failed login attempts triggering brute-force protection

If you're just trying to view the page

1. Wait — the limit resets on a timer, and the page usually tells you roughly how long
2. Stop refreshing; each retry can extend the block on some systems
3. If you are on a shared or corporate network, someone else on the same IP may have triggered it
4. Turn off a VPN, since heavily used VPN exit addresses hit rate limits constantly

If it's your site

1. Honour `Retry-After` rather than retrying immediately, and use exponential backoff with jitter when it is absent
2. Cache responses so repeated identical requests do not consume budget
3. Batch requests where the API supports it, and remove polling in favour of webhooks
4. On the server side, always send `Retry-After`; a 429 without it forces clients to guess and usually guess wrong
5. Rate limit per account rather than per IP where you can, so shared networks are not penalised as one

Reference

Status code

429

Reason phrase

Too Many Requests

Category

4xx — Client Error

Defined in

RFC 6585 §4