Cloud & DevOpsNote
A rate limit costs US$0 in NGINX, US$12 in AWS WAF and US$1,825 on Kong Konnect
Four places to put an API rate limit, priced for 1 crore requests a month, and the status code a client should get when it trips. List prices as of September 2026.
Putting a rate limit in front of an API that serves 1 crore requests a month costs anything from nothing to US$1,825 a month, and the bill depends on where the limit sits, not on the algorithm. NGINX’s open-source limit_req module does it inside the web server for no licence fee.1 AWS WAF charges US$1 a month for the rule plus US$0.60 per million requests inspected.2 Kong Konnect Plus meters the whole gateway at US$200 for every million requests past the first.3
The 2023 version of this piece explained token buckets and sliding windows, and quoted a claim that APIs are “300 times more likely to be attacked than websites”. We could not trace that figure to a study and have dropped it. The buyer’s question is narrower: which layer should hold the limit, what it costs there, and what the client should be told when it trips.
01Where the limit sits sets the bill
The limit itself is nearly free; a managed gateway that meters every request is not
Monthly list cost to rate-limit 1 crore API requests, US$, as of September 2026
Source: AWS WAF and Kong pricing pages; Cloudflare plan prices from TechBag's Cloudflare Application Security page; NGINX documentation · as of 30 September 2026 · NGINX excludes the servers you run it on; Kong is the whole managed gateway, capped at 1 crore requests on Plus; Cloudflare is a flat per-site plan
The cheap options have a catch. Cloudflare’s plans include one rate-limiting rule on Free, two on Pro and five on Business, and below Enterprise they count by IP address only; counting by header, cookie, path or a JSON body field, which is how you limit one customer’s API key, is the Enterprise “Advanced Rate Limiting” tier.4 Our view: a per-IP limit stops a crude flood and does nothing about one key called from a hundred addresses. Count per key at the cheapest layer that can see the key, which is usually the gateway or the application, not the CDN’s free tier.
02Tell the client 429, not 503
RFC 6585, published in April 2012, defined 429 Too Many Requests and lets the server add a Retry-After header saying how long to wait.6 NGINX still answers a rate-limited request with 503 unless you set limit_req_status.1 A 503 tells the client the server is down, and a well-written client retries, which is the opposite of what you want. GitHub is the pattern worth copying: 60 requests an hour unauthenticated, 5,000 with a personal token, 15,000 for an Enterprise Cloud organisation’s app, every limit returned in x-ratelimit-limit, -remaining, -used and -reset headers.7
03Rate is one limit of five
OWASP renamed this risk between its 2019 and 2023 API security lists, from “Lack of Resources & Rate Limiting” to “Unrestricted Resource Consumption”.8 The 2023 entry names execution timeouts, memory, operations per request, records per page and third-party spending limits. The last one is the Indian one: an OTP endpoint that sends an SMS on every call spends your money at whatever rate an attacker chooses, so cap the spend as well as the calls.
Buying in India. Every price above is USD list. Bought direct on a card, an Indian company self-assesses 18% IGST under reverse charge; through a reseller it gets an INR invoice with 18% GST.9 The regulation that bites is CERT-In’s Directions of 28 April 2022: denial-of-service attacks are on the list to report within six hours, and logs must be kept for 180 days, so a limit that logs what it rejected is evidence you will need.10 The DPDP Rules, notified on 13 November 2025, bring the security-safeguard duty into force on 13 May 2027; an API that lets a scraper page through customer records unthrottled is the failure that duty describes.11
Sources
- NGINX, ngx_http_limit_req_module (leaky bucket; limit_req_status defaults to 503) — undated page
- AWS WAF pricing (US$5 a web ACL, US$1 a rule, US$0.60 per million requests) — undated page
- Kong pricing, Konnect Plus (US$25 a control plane, 1M requests included, US$200 per extra million, 10M cap) — undated page
- Cloudflare, Rate limiting rules: availability by plan — updated 25 August 2026
- TechBag, Cloudflare Application Security intel page (Pro about US$20, Business about US$200 a site a month; INR and GST invoicing) — version of 30 September 2026
- IETF, RFC 6585, Additional HTTP Status Codes (section 4, 429) — April 2012
- GitHub Docs, Rate limits for the REST API — undated page
- OWASP API Security, API4:2023 Unrestricted Resource Consumption — 2023 edition
- TechBag, Pipedrive Campaigns intel page (USD billing without a GST invoice means 18% IGST under reverse charge) — version of 30 September 2026
- CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting, 180-day logs) — 28 April 2022
- MeitY, Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 — 13 November 2025
Related on TechBag: the Kong Konnect page for the gateway rate card, and the developer tools guide for where API gateways sit beside the rest of the toolchain.
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
