Rate limiting

Rate limiting caps how many requests a client can make in a given time, protecting a service from overload, abuse, or one noisy customer crowding out everyone else. The most common method is the token bucket: a bucket holds up to a fixed number of tokens, refills at a steady rate, and each request spends one; when it’s empty, requests are rejected or made to wait. That allows short bursts up to the bucket’s size while holding the long-run rate steady. A leaky bucket instead lets requests out at a constant pace. Simple fixed windows, like “100 per minute”, are easy but let a client send double the limit across a window boundary, which sliding windows fix. You meet all of this as HTTP 429 “Too Many Requests” responses.