Token Bucket vs Leaky Bucket

An API allows each client 100 requests per minute. One client sends all 100 requests in the first second of the minute, and then sends nothing.

Did the client break the limit? Over the whole minute, no. But during that first second, it sent requests at 60 times its average rate. The two classic rate limiting algorithms differ mainly in whether that sudden burst of requests is acceptable.

This lesson explains the token bucket and the leaky bucket. It shows how each one handles the same burst, and how to run a rate limiter on many servers.