Capping how many requests a client may make in a window, and returning a clear refusal rather than letting the system degrade for everyone.
It protects you from both abuse and accidents — a partner's retry loop can take an API down as effectively as an attack, and credential stuffing depends on unlimited attempts.
We set limits per client and per endpoint, return the standard headers so integrators can back off correctly, and tighten limits on authentication routes well below the rest.