System Design: rate limiting algorithms
This course examines rate limiting through the nine throttles of one real application. It starts with what each limit protects (capacity, a secret, a scarce resource or human time) and how that sets the number. It then covers the fixed window counter, the boundary burst that lets it allow twice its limit, the token bucket, and the sliding window log and counter, all compared on the same traffic. It closes with discriminators, key normalization, safelisting the health check and a token bucket implementation challenge.
What you'll learn
- ✓How the thing a limit protects decides its number
- ✓How a fixed window counter works and why it allows twice its limit at the boundary
- ✓How a token bucket separates burst size from sustained rate
- ✓The costs and accuracy of the sliding window log and the sliding window counter
- ✓How to choose and normalize the discriminator a request is counted against
- ✓The difference between a rate limit and a quota
What a limit protects
A rate limit isn't one idea. Every limit in a real application protects a different thing, and the thing it protects decides the algorithm, the number, and what the request is counted against.
Read the full lesson free →Curriculum
7 lessonsWhat a limit protects
Nine throttles in one application, the four things they protect, and how a rate limit differs from a quota.
The fixed window counter
How the fixed window counter puts the window number in the cache key and stays atomic in Solid Cache.
The boundary burst
Why a fixed window allows up to twice its limit at the boundary, and when that matters.
The token bucket
The token bucket separates burst capacity from refill rate and suits resources that regenerate over time.
Sliding windows
The exact but costly sliding window log compared with the cheap, approximate sliding window counter.
What you count against
Choosing and normalizing the discriminator, using two sign-in throttles, and safelisting the health check.
Putting it together
A recap with the measured comparison of all four algorithms and a challenge to implement a token bucket.