Rate Limiting at Scale: Building Fixed Window and Token Bucket in Go

Rate limiting is one of those things every backend engineer knows they need but few actually build from scratch. Most reach for a library. I built mine — two algorithms, Redis-backed, with Lua scripting for atomicity. Here's what the tradeoffs actually look like when you're writing the implementation instead of just configuring it. Why build it instead of using a library? Mostly to understand what the library is doing. Rate limiting looks simple until you think about concurrent requests hitting the same counter at the same millisecond. That's where the interesting problems live — and a library abstracts all of that away from you. I implemented two algorithms: fixed window and token bucket. They solve the same problem differently, and the difference matters depending on your traffic pattern. Fixed window The simplest mental model: you get N requests per time window. Window resets, counter resets. func ( fw * FixedWindow ) Allow ( key string ) ( bool , error ) { count , err := fw . store