Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

stwilson's avatar

Laravel Api Rate Limiting Throttle, Increase Limit Greater Than 60

Setting the api throttle middleware less than 60 works like this:

Route::get('myapi/{value}/{anothervalue}', 'MyApiController@getStuff')->middleware('throttle:5,1');

However, any setting greater than 60 is ignored:

Route::get('myapi/{value}/{anothervalue}', 'MyApiController@getStuff')->middleware('throttle:100,1');

I tried playing with the default $maxAttempts = 60 in the ThrottleRequests class, and that doesn't work. Could there be another overriding throttle besides this Middleware that limits requests to 60 per minute per IP?

0 likes
4 replies
stwilson's avatar
stwilson
OP
Best Answer
Level 16

I found it in Kernel.php:

        'api' => [
            'throttle:60,1',
            'bindings',
        ],

This was overriding any setting set above.

6 likes
llyupll's avatar

Holy crap, literally just made an account to tell you that this was the most helpful thing I've ever seen @stwilson Thank You!

1 like
srenert's avatar

I"m trying to implement this with Laravel 8 and it doesn't seem to be working. I changed the throttle to use the RateLimiter as suggested in the documentation. I've cleared cached in laravel, nothing seems to be taking any affect.... The requests always stop at 60

Kernel.php

protected $middlewareGroups = [
    'web' => [
        EncryptCookies::class,
        AddQueuedCookiesToResponse::class,
        StartSession::class,
        // \Illuminate\Session\Middleware\AuthenticateSession::class,
        ShareErrorsFromSession::class,
        VerifyCsrfToken::class,
        SubstituteBindings::class,
    ],

    'api' => [
        EnsureFrontendRequestsAreStateful::class,
        'throttle:10,1',
        SubstituteBindings::class,
    ],
];

RouteServiceProvider.php

public function boot()
{
    $this->configureRateLimiting();
    parent::boot();
}

protected function configureRateLimiting()
{
    RateLimiter::for('oauth_tvs', function (Request $request) {
        return Limit::perMinute(10)->by(optional($request->user())->id ?: $request->ip());
    });
}

api.php

Route::get('/throttle/{amount}', 'SomeController@throttleBatch')->middleware(['throttle:oauth_tvs']);

SomeController.php

public function throttleBatch(Request $request, $amount) {
    // Going to throttle up to $amount of requests
    try {
        $httpClient = new Client();
        for ($i = 0; $i <= $amount; $i++) {
            $req = $httpClient->post("someAPI", []);
            $response = $req->getBody()->getContents();
			Log::info("Success!");
        }
    } catch (\Throwable $e) {
        Log::info("errorCode: {$e->getCode()}");
    }
}

Please or to participate in this conversation.