API Rate Limiting Strategies
Compare token bucket, leaky bucket, and fixed window rate limiting. Where would you apply each?
Answers use simple, clear English.
Audio N/AQuick interview answer
Fixed window is simple but bursts at boundaries. Sliding window smooths that. Token bucket allows controlled bursts while sustaining an average rate — common for APIs.
Detailed answer
Fixed window is simple but bursts at boundaries. Sliding window smooths that. Token bucket allows controlled bursts while sustaining an average rate — common for APIs. Leaky bucket enforces a smooth outflow. Choose based on UX (bursts OK?) and place limits at gateway/edge plus per-tenant keys. Distributed limiters need Redis/atomic counters or mesh filters.
Full explanation
Distributed limiters need Redis/atomic counters or mesh filters.
Real example & use case
Public API: 100 req/min sustained with short bursts via token bucket per API key.
Pros & cons
Pros: protects backends. Cons: false positives hurt UX; clock skew and distributed counters are tricky.