Rate limiting

Cap the requests a client may send per second. Token bucket allows short bursts, leaky bucket smooths output, fixed windows are simple but let double bursts through at window edges, and sliding windows fix that at a small memory cost.

Where it shows up in real systems

  • API gateway

    Centralises cross-cutting concerns so services stay simple. Validating JWTs locally costs almost nothing, while calling an auth service on every request adds latency and a dependency.

    In production: Amazon API Gateway, Kong, Apigee, Azure API Management, Tyk

  • Rate limiter

    Protects the system from abusive clients and retry storms by answering HTTP 429 above the limit. Fixed windows let bursts through at window edges; sliding windows and token buckets are smoother.

    In production: Envoy rate limit service, Redis + Lua, NGINX limit_req, Cloudflare Rate Limiting

  • Email and SMS provider

    Delivery is slow and can fail, so send from background workers, never while the user waits. Providers throttle senders and track bounces; a burst of password-reset emails can hit the limit.

    In production: Amazon SES, SendGrid, Mailgun, Twilio, Postmark

See it break, then fix it

Build an architecture, send it a day of traffic and outages, and learn why it holds or fails. Free to start.

Open the learning path Open the sandbox