How do you design a Distributed API Rate Limiter and what algorithms are commonly employed?

A Rate Limiter protects backend services from Denial of Service (DoS) attacks, brute-force requests, and resource starvation by limiting client requests over defined time intervals.

Standard Algorithms:

• Token Bucket: A bucket holds up to $N$ tokens, refilled at a constant rate $r$ tokens/second. Each request consumes 1 token. Allows burst traffic while enforcing average rate. (Used by Amazon API Gateway and Stripe).
• Leaky Bucket: Requests enter a FIFO queue and leak out at a constant smooth processing rate. Excess requests drop when queue overflows.
• Sliding Window Counter: Computes requests in current window plus weighted percentage from previous window. Eliminates burst spikes at window boundary boundaries with minimal memory overhead.

Distributed Architecture: In multi-server microservices, rate limits are tracked in a centralized fast in-memory store like Redis using atomic operations (e.g. Redis Lua scripts or Redis sorted sets) to prevent race conditions.