What is 'API throttling vs rate limiting' and when would you use each for a public API?

• A.Throttling and rate limiting are identical concepts with different names
• B.Rate limiting restricts the number of requests in a time window (100 requests/minute - exceeding returns 429). Throttling degrades service quality for excess requests rather than rejecting them (slow down responses, prioritize lower-load clients). Rate limiting protects backend resources by rejecting excess; throttling provides graceful degradation. Public APIs often use rate limiting for abuse prevention and throttling for fair resource distribution among legitimate users
• C.Throttling is for paid APIs; rate limiting is only for free tier APIs; 429 responses are hop-by-hop, and intermediary caches strip them before they reach the calling client; rate limiting by API key is unnecessary under mutual TLS, since client certificates cannot be shared between callers; webhook signatures use the consumer's public key, letting the provider verify that the consumer received the event; a 304 from an API signals soft rate limiting, as caching semantics apply only to HTML responses; a 400 response means the server failed to parse its own configuration, while malformed client JSON yields 500