Post

1/ Ever watched your servers start sweating because a single rogue bot or a buggy client retry loop went wild and hammered your API with hundreds of requests per second? That’s rate limiting in action – the invisible guardrail that keeps your system alive, fair, and costs in check.

3/ 1. Token Bucket Tokens refill at a steady rate into a bucket. Each request grabs one. Run out? Block or queue. Superpower: Allows natural bursts (uploading 20 photos at once feels smooth). Real-world: Stripe, GitHub, AWS APIs. Pick this when your users are humans, not robots.

4/ 2. Leaky Bucket Requests pour in but only “leak out” to your servers at a fixed constant rate. Bucket fills up? Extra requests get dropped. Superpower: Perfectly smooth downstream traffic – your DB never sees spikes. Catch: Zero bursts allowed. Use when stability > flexibility.

5/ 3. Fixed Window Time sliced into rigid blocks (every 60 seconds). Count inside the block, reset sharp at the boundary. Superpower: Dead simple, almost zero memory. Big catch: Everyone games it – spam at 11:59 + 12:01 and you sneak double the limit.