Rate limiting without punishing bursty clients
Sliding windows, token buckets, and why we settled on a hybrid that absorbs a 10x burst without letting a runaway loop drain your quota.
Rate limiting is a negotiation between two failure modes. Too strict and you break legitimate traffic that happens to arrive together. Too loose and one bug in a customer's retry loop consumes a month of allowance in an afternoon.
Fixed windows are the worst of both
A fixed window resets on the minute, so a client can send its full allowance at 59 seconds and again at 61. You have permitted double the rate you advertised, and you did it at exactly the moment you were least prepared.
What we run
A sliding window for the advertised per-minute limit, and a separate monthly quota that does not reset until the billing period does. The window absorbs a burst; the quota is what you actually bought.
Failing usefully
A 429 carries Retry-After and the remaining allowance. A limit that does not tell you when to try again is just an error.