sysdesign-rate-limiting-strategies

Compare rate-limiting algorithms by evaluating burst handling needs: token bucket allows bursts up to capacity, leaky bucket smooths output flow, fixed window resets counts per period, and sliding window prevents boundary spikes for precise throttling.

Use Redis, DynamoDB, or in-process stores for API throttling counters based on whether you need stateful or stateless limits. Stateful counters in distributed stores like Redis preserve limits across restarts, while stateless approaches reduce latency.

Configure a 429 response contract for API rate limits by documenting the retry-after headers, per-scope blocking details, and throttling scope definitions. A clear contract informs clients when to retry requests after hitting rate boundaries.

Apply rate limiting per user, endpoint, API key, or IP by defining scope definitions that target specific traffic dimensions. Scoping ensures throttling rules apply precisely to the identified abuse vector while leaving other traffic unaffected.

Fixed window rate limiting has limitations with boundary bursts, where traffic spikes occur exactly at window reset points. Sliding window or token bucket strategies mitigate this by distributing capacity over time for better burst control.