An API rate limiting system may receive a client request from an API client associated with a tenant, formulate a proxied request with an internal authentication specific to the tenant, and send the proxied request to API endpoints (tenant resources) at a store. The store fulfills the request, accessing and modifying local database(s) as needed, and returns a response to the system. The system returns the response to the API client along with information about the API client's quota for the current time window. The system may calculate the quota based on a resource limit with respect to a number of clients accessing a resource. In some embodiments, the system may implement an exponential distribution function in making a determination on a quota per API client per time window.