Use message throttling

[sarroutbi]

To protect against brute-force DoS attacks, use a feature that enforces a set number of failed attempts by a certain IP, API key, or request route during a set period. For example, a web API could allow an IP to have a maximum number of requests within a second, minute, or hour.

You should also consider using a feature that throttles multiple requests from, or originating from, the same user (API key). This reduces the likelihood of a brute-force attack.