Rate Limiting Your API: Algorithms, Tradeoffs, and Implementation

Why Rate Limiting Matters Without rate limiting, a single misbehaving client can: Exhaust your database connection pool Burn through your OpenAI credits in minutes Make your service unavailable for everyone else Rate limiting is infrastructure, not an afterthought. The Algorithms 1. Fixed Window Count requests in fixed time buckets (e.g., 100 requests per minute). const requests = new Map<string, { count: number; resetAt: number }>(); function isRateLimited(clientId: string, limit: number, windowMs: number): boolean { const now = Date.now(); const window = requests.get(clientId); if (!window || now > window.resetAt) { requests.set(clientId, { count: 1, resetAt: now + windowMs }); return false; } if (window.count >= limit) return true; window.count++; return false; } Problem: A client can make 100 requests at 11:59 and 100 more at 12:00—200 requests in 2 seconds. 2. Sliding Window Count requests in a rolling window, not a fixed bucket. const timestamps = new Map<string, n