How rate limiting works

Protect a service by deciding which requests fit a time-based budget. Watch the same burst cross a window boundary under three policies.

When to use it

A public API needs per-client quotas while allowing small bursts.

Explore the tradeoffs

A fixed-window quota is not a rolling-window guarantee. Counters are compact, but their reset boundary permits bursts.

The oldest accepted timestamp determines when another request can enter. Precise rolling limits require more state than one counter.

Bucket capacity controls burst size; refill controls sustained admission. A token bucket intentionally allows bursts and does not enforce a strict sliding quota.

Model boundaries

One client, one atomic limiter and a reliable clock. Distributed counters, clock skew and limiter outages are not modeled.