How do you protect a public API from abuse?

Deep dive

A layered approach prevents abuse and reduces blast radius:

• API keys or OAuth; per-tenant quotas and per-IP rate limits.
• Validation and schema checks to reject malformed requests early.
• WAF rules, bot detection, and IP reputation.
• Backpressure and circuit breakers to protect downstreams.

Examples

Rate limiting headers:

X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 42
X-RateLimit-Reset: 1710000000

Common pitfalls

• Only global limits (one noisy tenant hurts all).
• No observability: you see abuse after downtime.
• Ignoring idempotency for retried requests.

Interview follow-ups

• How do you set limits for paid vs free tiers?
• How do you handle burst traffic from a good customer?
• What metrics would you alert on?