Token bucket per user

RateLimiter limiter = perUserLimiters.computeIfAbsent(userId,
    u -> RateLimiter.create(20));  // 20 QPS/user
if (!limiter.tryAcquire()) {
  throw new RateLimitException(userId);
}
Advertisement

Multiple dimensions

Requests/second. Tokens/day. Cost/month. Different windows, different limits.

Advertisement

Distributed limiting

Single-instance limiters miss the multi-instance case. Use Redis-backed limiters for real distributed limits.