Rate limiting sets a cap on how often something can be requested within a period, such as a number of login attempts per minute. Requests beyond the cap are slowed or refused for a while, and normal use below the cap carries on untouched. The limit is chosen to be generous for real people.
It protects a service in two ways. It stops one over-eager program from using up capacity everyone else needs, and it makes automated guessing of passwords or mass form submissions impractical. When you connect systems through an API, you may meet rate limits from the other side, so well-built integrations pace themselves and retry politely.