Backend · core
Rate Limiting
Token bucket, leaky bucket, sliding window.
Mental model
Rate limiting protects a shared resource from any one caller. Token bucket is the workhorse: tokens refill at a steady rate, each request spends one, an empty bucket means 429 — allowing bursts up to the bucket size.
How to study Rate Limiting
Begin by restating the mental model in your own words, then connect it to a concrete system you have built or operated. Name the mechanism, the constraint it addresses, and the trade-off it introduces. Use 429 Too Many Requests (MDN) to check details, but close the source before writing your explanation. Retrieval is the learning step; rereading is only preparation.
Next, compare Rate Limiting with API Keys, Idempotency. Ask what changes in correctness, latency, resource use, operability, and failure recovery. Complete Implement a token-bucket rate limiter and preserve the command, input, output, and one failed attempt as evidence. Finish by explaining the idea without jargon to someone who has not studied the track.
Proof of understanding
- Explain the mechanism from first principles and identify the state it reads or changes.
- Give one situation where the concept is the right choice and one where it is not.
- Predict a realistic failure mode before running the drill, then compare the prediction with evidence.
- Connect the result to a roadmap or build artifact instead of treating the concept as isolated trivia.
Where it matters
API gateways, every public API.
Common mistakes
- Fixed-window counters that allow 2x burst at the boundary
- Limiting per-server instead of globally in a cluster
- No Retry-After header on 429 responses
Learn from primary sources
Practice and explain it back
Implement a token-bucket rate limiter
Implement a token bucket: tokens refill at a fixed rate, each request spends one, an empty bucket returns 429 with Retry-After.
Expected evidence: Allows bursts up to bucket size, then throttles to the refill rate.
Open the interactive drill →Review prompts
- How does a token bucket differ from a fixed-window counter?
Build evidence
Reusable rate limiter
A token-bucket rate limiter usable as middleware.
- Token bucket with configurable rate and burst
- Returns 429 with a Retry-After header
- Works across processes (shared store)