Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

lirone's avatar

Handle 429 error message : TOO MANY REQUESTS on website.domain

Hi,

I'm using Laravel Json API (https://laravel-json-api.readthedocs.io/) for building an API. This API is called from another app.

However, after a certain amount of call, I have this error

429 TOO MANY REQUESTS on website.domain

I saw that one solution was to comment the throttle parameter in the kernel. However, for security reason, I don't want to do that. So my question is : how to remove this limitation only for a specific IP/adress ?

Thank you in advance,

0 likes
10 replies
lirone's avatar

Thank for the link.

I tried sommething like this

RateLimiter::for('api', function (Request $request) {
            if ($request->ip() == "IP") {
                return Limit::perMinute(1000)->by(optional($request->user())->id ?: $request->ip());
            }
            return Limit::perMinute(60)->by(optional($request->user())->id ?: $request->ip());
        });

But it does not work. Did I miss something ?

automica's avatar

@lirone

does not work.

is it not matching your ip?

if put a dd($request->ip()) just inside that method what do you see?

1 like
lirone's avatar

Ok it works ! I made a mistake on the IP adress as I was working on local. My bad.

I have a last question. I had difficulties to understand this line

by(optional($request->user())->id ?: $request->ip())

Can you please explicit me more ?

automica's avatar

@lirone by() is a method on the Limit class that filters by user.

The

(optional($request->user())->id

is checking if you have a user, and if so, getting the id of it as if you just did

$request->user()->id

and you didn't have a user, then you would getting an error as you would be trying to get an id off an object that didn't exist.

its the same as doing:

$id = isset($request->user()) ? $request->user()->id : null;

or old school

$id = null;

if(isset($request->user()){
$id = $request->user()->id; 
}
1 like
lirone's avatar

And so if the users does not exists, it take the IP right ?

1 like
cleargoal's avatar

Hi, guys,

help me, please!

I fill a simple rate limiter, as described in the doc, just copy/paste:

    protected function configureRateLimiting(): void
    {
        RateLimiter::for('api/v2', function (Request $request) {
            return Limit::perMinute(10000);
        });
    }}

but it has no effect. Any advice, please.

Please or to participate in this conversation.