--- title: Drive application performance and stability with global... description: Ngrok's Traffic Policy module now supports a global Rate Limit action for API gateway users, letting teams cap request volume to protect upstream services from... canonical: https://daily.dev/posts/drive-application-performance-and-stability-with-global-rate-limiting-w7yhlrpaz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Drive application performance and stability with global rate limiting | daily.dev og:description: Ngrok's Traffic Policy module now supports a global Rate Limit action for API gateway users, letting teams cap request volume to protect upstream services from... og:url: https://daily.dev/posts/drive-application-performance-and-stability-with-global-rate-limiting-w7yhlrpaz og:image: https://api.daily.dev/og/posts/w7yHlrpAZ.png og:image:alt: Drive application performance and stability with global rate limiting og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Drive application performance and stability with global rate limiting **[ngrok Blog](https://daily.dev/sources/ngrok)** · 5 min read · 0 upvotes · 0 comments ## Summary Ngrok's Traffic Policy module now supports a global Rate Limit action for API gateway users, letting teams cap request volume to protect upstream services from overload or abuse. Configuration involves setting a capacity (max requests) and rate (time window) using a sliding window algorithm, with optional bucket keys (IP address, hostname, HTTP header values) to apply limits per client rather than globally. Multiple rate limiters can be layered, and limited requests receive an HTTP 429 response with a Retry-After header. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does ngrok's rate limit action decide whether to allow or block a request? It uses a sliding window algorithm that counts requests made in a defined time window and compares that count to a configured capacity. For example, a rate limiter set with a capacity of 93 and a rate of 5 minutes forwards a request only if fewer than 93 requests have occurred in the trailing five-minute window, otherwise it responds with HTTP 429 and a Retry-After header. _daily.dev surfaces practical configuration details like this for engineers hardening API traffic controls._ ### How can I rate limit API requests per client IP address instead of globally with ngrok? Configure a bucket key on the Rate Limit policy action using the client IP address so each IP gets its own request counter instead of sharing one global limit. Bucket keys can also combine hostname or HTTP header values, such as an Authorization header, to rate limit per OAuth user or per domain on a multi-domain edge. _Engineers designing fair-use traffic policies can track configuration patterns like these on daily.dev._ ### What response does a client get when it exceeds an API rate limit on ngrok? The client receives an HTTP 429 Too Many Requests response along with a Retry-After header specifying how many seconds to wait before retrying. Retrying before that interval elapses results in the request being rate limited again. _daily.dev helps developers stay current on API traffic management practices like handling 429 responses._ ## Similar posts on daily.dev - [Rate limiting for LLM applications: Why it matters and how to implement it](https://daily.dev/posts/rate-limiting-for-llm-applications-why-it-matters-and-how-to-implement-it-xodmsr6nv) · portkey · 0 upvotes · 0 comments - [Python Rate Limiting: The Limiter That Caused Our Outage](https://daily.dev/posts/python-rate-limiting-the-limiter-that-caused-our-outage-2y3xnfeyu) · SitePoint · 0 upvotes · 0 comments - [Rate Limiting in NestJS Using Throttler](https://daily.dev/posts/rate-limiting-in-nestjs-using-throttler-my1m1lqxm) · Telerik · 5 upvotes · 0 comments - [Rate Limiting Your SaaS API: A 2026 Developer Guide](https://daily.dev/posts/rate-limiting-your-saas-api-a-2026-developer-guide-mozn1rshe) · Alex CloudStar · 0 upvotes · 0 comments --- Tags: [#devtools](https://daily.dev/tags/devtools), [#api-gateway](https://daily.dev/tags/api-gateway) [View this post on daily.dev](https://daily.dev/posts/drive-application-performance-and-stability-with-global-rate-limiting-w7yhlrpaz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Drive application performance and stability with global rate limiting","url":"https://daily.dev/posts/drive-application-performance-and-stability-with-global-rate-limiting-w7yhlrpaz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/drive-application-performance-and-stability-with-global-rate-limiting-w7yhlrpaz"},"datePublished":"2026-08-23T07:21:28.753Z","dateModified":"2026-08-23T07:28:22.100Z","description":"Ngrok's Traffic Policy module now supports a global Rate Limit action for API gateway users, letting teams cap request volume to protect upstream services from...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/da5f19a660cbce5e2fc146df3af8ce8a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/da5f19a660cbce5e2fc146df3af8ce8a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/drive-application-performance-and-stability-with-global-rate-limiting-w7yhlrpaz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"devtools,api-gateway","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"Drive application performance and stability with global rate limiting"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/drive-application-performance-and-stability-with-global-rate-limiting-w7yhlrpaz#faq","mainEntity":[{"@type":"Question","name":"How does ngrok's rate limit action decide whether to allow or block a request?","acceptedAnswer":{"@type":"Answer","text":"It uses a sliding window algorithm that counts requests made in a defined time window and compares that count to a configured capacity. For example, a rate limiter set with a capacity of 93 and a rate of 5 minutes forwards a request only if fewer than 93 requests have occurred in the trailing five-minute window, otherwise it responds with HTTP 429 and a Retry-After header. daily.dev surfaces practical configuration details like this for engineers hardening API traffic controls."}},{"@type":"Question","name":"How can I rate limit API requests per client IP address instead of globally with ngrok?","acceptedAnswer":{"@type":"Answer","text":"Configure a bucket key on the Rate Limit policy action using the client IP address so each IP gets its own request counter instead of sharing one global limit. Bucket keys can also combine hostname or HTTP header values, such as an Authorization header, to rate limit per OAuth user or per domain on a multi-domain edge. Engineers designing fair-use traffic policies can track configuration patterns like these on daily.dev."}},{"@type":"Question","name":"What response does a client get when it exceeds an API rate limit on ngrok?","acceptedAnswer":{"@type":"Answer","text":"The client receives an HTTP 429 Too Many Requests response along with a Retry-After header specifying how many seconds to wait before retrying. Retrying before that interval elapses results in the request being rate limited again. daily.dev helps developers stay current on API traffic management practices like handling 429 responses."}}]} ```