Learn › System Design Playbook › Design a Rate Limiter

Design a Rate Limiter

2 min read

A rate limiter caps how many requests a client can make in a window — protecting against abuse, runaway clients and cost overruns.

Limit per client (API key / user / IP), e.g. 100 req/min.
Low latency (it's on every request), accurate, works across a distributed fleet.
Return 429 Too Many Requests + Retry-After when exceeded.

Algorithm	Idea	Trade-off
Token bucket	Bucket refills at a rate; each request takes a token	Allows bursts; the go-to default
Leaky bucket	Requests drain at a fixed rate	Smooths bursts, adds latency
Fixed window	Count per calendar minute	Simple; 2× burst at the boundary
Sliding window	Weighted blend of two windows	Good accuracy/memory balance

The counter must be shared — otherwise each server allows the full limit.

Request ─▶ App ─▶ Redis (INCR key, check limit) ─▶ allow / 429

key   = "rl:{user}:{window}"
count = INCR key
if count == 1: EXPIRE key 60
if count > limit: return 429

Use a Lua script so "check + increment + set TTL" is atomic, avoiding races.

Where: at the API gateway / edge so bad traffic is rejected early.
Trade-off: central Redis adds a hop and a dependency — shard it or cache buckets locally.
Fairness: separate limits per tier (free vs paid).

Takeaway: token bucket + atomic Redis counter is the standard, interview-ready rate limiter.

Rate Limiter Design करें

एक rate limiter तय करता है कि एक client एक window में कितनी requests कर सकता है — दुरुपयोग, बेलगाम clients और ख़र्च से बचाव के लिए.

Algorithm	विचार	Trade-off
Token bucket	bucket एक rate से भरता है; हर request एक token लेती है	bursts देता है; सबसे आम default
Leaky bucket	requests तय rate से निकलती हैं	bursts smooth करता है, latency जोड़ता है
Fixed window	हर मिनट गिनती	सरल; boundary पर 2× burst
Sliding window	दो windows का weighted मिश्रण	अच्छा accuracy/memory संतुलन

Counter shared होना चाहिए — वरना हर server पूरी limit दे देगा.

Request ─▶ App ─▶ Redis (INCR key, limit जाँचें) ─▶ allow / 429

key   = "rl:{user}:{window}"
count = INCR key
if count == 1: EXPIRE key 60
if count > limit: return 429

एक Lua script इस्तेमाल करें ताकि "check + increment + TTL" atomic हो और race न हो.

कहाँ: API gateway / edge पर, ताकि ख़राब traffic जल्दी ठुकर जाए.
Trade-off: central Redis एक hop और dependency जोड़ता है — इसे shard करें या buckets locally cache करें.
Fairness: हर tier की अलग limit (free vs paid).

सार: token bucket + atomic Redis counter मानक, interview-ready rate limiter है.