Token Bucket vs Sliding Window: How to Build a Distributed Rate Limiter

A rate limiter controls how many requests a client can make within a given time period, protecting API capacity and enforcing fair usage across tenants. Two widely used algorithms are token bucket, which allows short bursts by letting clients accumulate tokens, and sliding window counter, which approximates a rolling time window for smoother, more predictable limits. Fixed window is the simplest approach but has a boundary flaw that can allow double the intended request rate, making it unsuitable for security-sensitive use cases. In distributed systems with multiple servers, shared state is critical — Redis is the standard choice, using atomic Lua scripts to prevent race conditions during read-modify-write operations. Production deployments must also handle Redis failures by choosing between failing open for availability or failing closed for stricter endpoints like payments or authentication.