How do rate-limiting algorithms work (fixed window, sliding window, token bucket)?

Summary

Fixed window counts requests per time window (simple, bursty at boundaries); sliding window smooths this by weighting the previous window or logging timestamps; token bucket refills tokens at a steady rate and allows bursts up to bucket capacity; leaky bucket processes requests at a constant rate.

Longer Answer

Distributed limits need a shared store (Redis with atomic Lua scripts) or edge enforcement. Return 429 Too Many Requests with Retry-After, and key limits by API key, user, IP (carefully behind proxies) or tenant.

Key Points

• Fixed window: simple, boundary bursts
• Sliding window: smoother
• Token bucket: controlled bursts
• Redis/edge for distributed limits
• 429 + Retry-After