Token Bucket Rate Limiter with Standard Rate-Limit Headers

Asked at Okta · Coding Questions · Difficulty: Medium · Last asked Oct 6, 2026

An API protects itself with a token-bucket rate limiter. Every client key (an API key or an IP address) has its own bucket. A bucket holds at most `capacity` tokens and refills continuously at `refill_per_second` tokens per second. Each request takes one token; a request that finds less than one token is rejected with `429 Too Many Requests`. Every response also carries the standard rate-limit headers, so that a well-behaved client knows when to slow down and when to retry. Implement the limiter, its configuration check and the headers.

Loading the problem…