Simple rate limit: 100 requests per minute. Count them, reset at the top of each minute.
Now watch someone send 100 at 10:00:59 and 100 more at 10:01:00.
Two hundred requests in one second. Every rule obeyed. This is the fixed window problem — the reset is a cliff, and traffic piles up on both sides of it.
The better mental model is a bucket of tokens:
- The bucket holds 100 tokens
- It refills at 100 per minute, continuously
- Each request takes one
- An empty bucket refuses the request
No cliff. No reset moment to game. And because the bucket can sit full, a user who's been quiet keeps their right to a short burst — which is exactly what real, well-behaved clients do.
Fixed windows punish bursts. Token buckets budget for them.