A Comparative Survey of API Rate-Limiting Algorithms: Token Bucket, Leaky Bucket, and Sliding Window

Rate limiting is a foundational mechanism for protecting networked services and application programming interfaces (APIs) from overload, abuse, and cascading failure. A wide range of algorithms has been proposed to enforce request-rate constraints, each offering different trade-offs between burst tolerance, memory footprint, timing precision, and implementation complexity. This paper surveys five widely used rate-limiting techniques: the token bucket, the leaky bucket, the fixed window counter, the sliding window log, and the sliding window counter. For each algorithm we describe the underlying mechanism, summarize its principal advantages and limitations, and compare the techniques both qualitatively and experimentally. We implement all five algorithms and evaluate them on an identical synthetic traffic trace containing two artificial burst events, reporting acceptance rate, peak instantaneous throughput, and burst behavior for each. The results show that the token bucket and leaky bucket are decision-equivalent as admission meters, that the sliding window log is the only algorithm with zero tolerance for exceeding its configured limit, and that the fixed and sliding window counters fall predictably between these extremes. We conclude with concrete guidance on selecting an algorithm based on measured traffic characteristics and system constraints.