Rate Limiter (Token Bucket)

Picture a bucket that holds a few tokens. Each time you make a request, you spend one token. If the bucket is empty, you must wait — the system blocks you. The bucket slowly refills over time, one token at a time. So after a short wait, you can make requests again. This is a rate limiter. It lets you burst a lot of requests for a short time. But it stops anyone from hammering the system nonstop.

1. 1Give each user (or API key) a bucket with a maximum size — say, 3 tokens.
2. 2When a request comes in, first refill the bucket a little. Base the refill on the time since the last check: elapsed time ÷ refill rate = new tokens. Never go above the bucket's capacity.
3. 3If the bucket has at least one token, take one and allow the request. If the bucket is empty, block the request.

Use a rate limiter when your app gets popular. One user, or one buggy script, could send your server thousands of requests a second. A rate limiter protects everyone else by capping how fast any single caller can go.

• ⚠Using the real system clock makes examples and tests unpredictable. In production, you read the real clock. But always pass the time in as a value, so your logic stays testable.
• ⚠Forgetting to cap the bucket at its maximum size. Without a cap, tokens would pile up forever if nobody used the API for a while.