Protecting Your Resources
An API without rate limiting is a Denial of Service attack waiting to happen. But implementing a counter requests_per_minute isn't as simple as it sounds.
Algorithm 1: Fixed Window
You allow 100 requests per minute. If a user sends 100 requests at 12:00:59 and another 100 at 12:01:01, they effectively sent 200 requests in 2 seconds, potentially crashing your DB. This 'burst' issue at the window boundary is why Fixed Window is flawed.
Algorithm 2: Token Bucket (Preferred)
Imagine a bucket that holds 100 tokens. A 'Refiller' adds 1 token every second. Each API request costs 1 token. If the bucket is empty, the request is rejected (429 Too Many Requests). This allows for short bursts (up to 100) but enforces a strict long-term average (1 req/sec). This is how AWS and Stripe handle limiting.
Infrastructure: Redis Lua
You cannot effectively rate limit using a local array in Node.js or PHP because you have multiple server instances. You need a centralized store like Redis. Using a Lua script ensures the 'Check and Decrement' operation is atomic, preventing race conditions under high load.