DSA & System Design
All the basics

What is a rate limiter?

Count how many requests each client sends, and politely turn away the extras, so one noisy client cannot slow everyone down.

A turnstile with a counter. Only a few people get through each second, and the rest wait their turn instead of crowding the door.

Press Play to watch it run · 5 steps

Without a limit one noisy client floods the service. With a limit, extra requests are refused at the entry.

No limit, or a count per clientWithout a limit one noisy client floods the service. With a limit, extra requests are refused at the entry.Noisy clientEntry server 1Shared countEntry server 2Your service

Tap any box to see what it is and what it talks to.

  • Client
  • API gateway
  • Cache
  • Service
Open in playground
Text description
  1. One noisy client sends 1,000 requests a second.
  2. With no limit, every one of them goes through to your service.
  3. Your service is swamped and slows down for everyone.
  4. A normal user sends one request.
  5. It times out. One client broke it for everybody.
  • Each client gets its own allowance, so one cannot starve the rest.
  • Extra requests are refused quickly with a polite "slow down".
  • With many servers, the counts must live in one shared place.

Reach for it when

On any public API, so one buggy client looping at 1,000 requests a second cannot slow everyone. Internal-only tools may skip it.

The catch

With two entry servers each counting alone, a client with a limit of 10 quietly gets 20, so counts must be shared.

Say it in an interview“I would limit per client in the gateway, with counts in a shared fast store like Redis, and return 429 with a Retry-After header.”