API Rate Limiting Strategies
Compare token bucket, leaky bucket, and fixed window rate limiting. Where would you apply each?
Answers use simple, clear English.
Quick interview answer
Fixed window is simple but bursts at boundaries. Sliding window smooths that. Token bucket allows controlled bursts while sustaining an average rate — common for APIs.
Detailed answer
Fixed window is simple but bursts at boundaries. Sliding window smooths that. Token bucket allows controlled bursts while sustaining an average rate — common for APIs. Leaky bucket enforces a smooth outflow. Choose based on UX (bursts OK?) and place limits at gateway/edge plus per-tenant keys. Distributed limiters need Redis/atomic counters or mesh filters.
Full explanation
Distributed limiters need Redis/atomic counters or mesh filters.
Real example & use case
Public API: 100 req/min sustained with short bursts via token bucket per API key.
Pros & cons
Pros: protects backends. Cons: false positives hurt UX; clock skew and distributed counters are tricky.