# Rate Limiter Algorithms

> Select and implement rate-limiter algorithms (token bucket, leaky bucket, fixed/sliding windows), key design, Redis/Lua distribution, and production anti-patterns. Use when building quotas beyond basic RateLimit headers.

- Skill: `deangrant/rate-limiter-algorithms` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add deangrant/rate-limiter-algorithms`
- Raw SKILL.md: https://api.skillmd.com/api/skills/deangrant/rate-limiter-algorithms/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: deangrant (https://skillmd.com/u/deangrant)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/deangrant/rate-limiter-algorithms

---


# Rate Limiter Algorithms

Use this skill when choosing **how** to limit — deeper than HTTP header
conventions alone.

---

## 1. Algorithm selection

| Need | Prefer |
| ---- | ------ |
| Bursty legit clients | **Token bucket** (Stripe/AWS-style) |
| Strict rolling count at scale | **Sliding window counter** |
| High precision (auth/pay) | **Sliding window log** (ZSET + Lua) |
| Smooth downstream drain | **Leaky bucket** |
| Simple internal only | **Fixed window** (watch boundary spikes) |

Token bucket: `capacity` = burst; `refillRate` = sustained; `Retry-After` ≈
tokens deficit / refill.

---

## 2. Key selection

Check **idempotency store before** rate limit (replays free). Primary key =
user ID or API key; tier by subscription. Per-endpoint limits on expensive
routes. IP only as defensive heuristic — not primary on auth endpoints.

---

## 3. Distributed

Fleet-wide Redis/Lua (or equivalent). Fail-open vs fail-closed is an explicit
product decision. Shadow mode before enforce. Prometheus alerts on reject rate.

---

## 4. Anti-patterns

URL-path-only keys; fail-closed without capacity planning; no `Retry-After`;
relying on IP alone behind NAT.

---

## 5. Quick checklist

- [ ] Algorithm matches burst vs smoothness needs.
- [ ] Keys: identity + endpoint + tenant as required.
- [ ] Idempotency checked before counting.
- [ ] Distributed atomicity; headers on reject.
- [ ] Rollout: shadow → enforce.

See [reference.md](reference.md) and [examples.md](examples.md).