Rate Limiting Interview Questions

The goal is to protect the backend and enforce a plan, say 100 requests per minute per API key. I would put this at the gateway, not in every service. Token bucket is what I would implement: you get a burst, then a steady refill. Fixed windows are simpler but people slam the boundary. Sliding log is accurate and more expensive. Counters live in Redis with INCR and EXPIRE, or a small Lua script so two app nodes do not race. I key by user id or API key, not only IP, because NAT shares IPs. When they are over limit I return 429 with Retry-After. I would accept approximate limits in a distributed setup rather than a global lock on every request.

Token bucket is simple and allows short bursts. Fixed window is even simpler but a user can double-fire at the window edge. Sliding window or sliding log is fairer and heavier. For a public API I would start with token bucket in Redis per API key, then tighten if people game the edge. I would say the algorithm name and the key — user, IP, or apiKey — because the key is half the design.

I would enforce at the gateway for coarse protection so bad traffic never hits every pod. I would still enforce in the service for business rules — like 5 OTPs per phone per hour — because the gateway may not know that domain key. Two layers. I would return 429 with a Retry-After. I would not only rate-limit in app code and then get killed at the load balancer.

Local in-memory counters will not agree. I would use Redis INCR with TTL or a token-bucket script so all pods share state. I accept that Redis is then on the request path and I must fail open or closed on Redis errors — I would pick fail closed for auth/OTP and fail open for a marketing page. I mention that choice. Split-brain local limits are how people blow OTP budgets.

I would document the limit, the window, and Retry-After. The app should back off, not retry in a tight loop. I would give them a sandbox key with a higher limit. I would not hide the limit and then ban them. For login I would also add captcha after N 429s. This is API product design, not only a Redis snippet.