Every public API needs rate limiting. Without it, a single bad actor — or a single misconfigured client — can take down your entire …

source