429 Too Many Requests

The client has sent too many requests in a given time (rate limiting).

429 at a glance

Code: 429
Name: Too Many Requests
Class: 4xx Client error
Status: IANA-registered standard code
Defined in: RFC 6585, Section 4
Cacheable by default: No by default. Caches store it only when the response carries explicit freshness (Cache-Control max-age, s-maxage or Expires).

What 429 means

429 Too Many Requests (RFC 6585) means a rate limit was hit. The server may say when to retry with Retry-After, and many APIs add headers with the limit, remaining quota and reset time. Clients should back off rather than retry immediately, otherwise they extend the block.

What typically causes a 429

API rate limits (OpenAI, Stripe, Shopify, Slack, Discord and most public APIs).
Cloudflare rate-limiting rules; AWS WAF rate-based rules; API Gateway throttling (returns 429 "Too Many Requests").
nginx limit_req when configured with limit_req_status 429; (the default status is 503).
Crawlers or scripts hitting a site too fast; shared IPs (NAT, VPNs, CI runners) pooling their quota.

Fix it on the server

Send Retry-After (seconds or an HTTP date) and limit headers such as RateLimit-Policy/RateLimit (IETF draft) or X-RateLimit-*.
Set limit_req_status 429; in nginx so clients see the right code.
Rate-limit per API key or user, not only per IP, so users behind NAT are not punished together.

Fix it as a client or visitor

Honour Retry-After, then retry with exponential backoff and jitter.
Batch requests, cache responses, and spread scheduled jobs away from the top of the hour.

Headers that go with 429

Header	Role
`Retry-After`	Seconds to wait, or a date.
`RateLimit / RateLimit-Policy`	IETF draft headers for quota and reset.
`X-RateLimit-Remaining`	Common vendor header for remaining requests.

Example response

HTTP/1.1 429 Too Many Requests
Retry-After: 30
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 0
Content-Type: application/json

{"error": "rate_limited"}