API Rate Limiting & Scalability Patterns · Lesson

Token Bucket Algorithm Mechanics

Explore the token bucket algorithm, understanding its flexibility in allowing bursts and its common use cases in modern systems.

Token Bucket Algorithm Mechanics is a free API Rate Limiting & Scalability Patterns lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the API Rate Limiting & Scalability Patterns learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Meet the Token Bucket

Welcome to the Token Bucket algorithm! After exploring fixed windows and leaky buckets, we'll now dive into a flexible approach that’s widely used in modern systems.

The Token Bucket is a rate-limiting algorithm that allows for bursts of traffic while still enforcing an average rate limit.

Tokens in a Virtual Bucket

Imagine a virtual 'bucket' that holds a certain number of 'tokens'. Each token represents permission for one API request.

When a request arrives, it tries to take a token.
If a token is available, the request proceeds, and the token is removed.
If no tokens are available, the request is typically denied or queued.

Filling Up the Bucket

Tokens are continuously added to the bucket at a constant, predefined rate. This rate determines the average number of requests allowed over time.

For example, if tokens are added at 5 tokens per second, your API can sustain an average of 5 requests per second.

The Bucket's Maximum Size

Just like a real bucket, our virtual token bucket has a maximum capacity. This means it can only hold a certain number of tokens at any given time.

If tokens are generated but the bucket is full, the new tokens are discarded.
This capacity limits the maximum size of a 'burst' of requests that can be handled.

Requesting a Token

When an API client makes a request, the rate limiter checks the token bucket:

If tokens are available: One token is consumed, and the request is allowed to proceed.
If no tokens are available: The request is blocked, rejected (e.g., with HTTP 429 Too Many Requests), or deferred.

The Power of Bursts

The key advantage of the Token Bucket algorithm is its ability to allow bursts. If the bucket has accumulated many tokens (up to its capacity), a sudden rush of requests can be served immediately.

Once the accumulated tokens are used up, the rate limit reverts to the sustained token generation rate.

Token Bucket in Action

Try running this simplified Java example to see how tokens are refilled and consumed. Notice how initial requests can burst, but subsequent requests depend on refills.

public class Main {
  // Simple TokenBucket class for demonstration
  static class TokenBucket {
    private int capacity;
    private int tokens;
    private int refillRate; // tokens per "tick"

    public TokenBucket(int capacity, int refillRate) {
      this.capacity = capacity;
      this.tokens = capacity; // Start full
      this.refillRate = refillRate;
    }

    public void refill() {
      tokens = Math.min(capacity, tokens + refillRate);
      System.out.println("Refill. Tokens: " + tokens);
    }

    public boolean tryConsume(int numTokens) {
      if (tokens >= numTokens) {
        tokens -= numTokens;
        System.out.println("Consume " + numTokens + ". Left: " + tokens);
        return true;
      }
      System.out.println("Fail to consume " + numTokens + ". Left: " + tokens);
      return false;
    }

    public int getTokens() {
      return tokens;
    }
  }

  public static void main(String[] args) {
    // Bucket: capacity 5, refills 1 token per tick
    TokenBucket bucket = new TokenBucket(5, 1);

    System.out.println("Start. Tokens: " + bucket.getTokens());

    // 1. Initial burst
    System.out.println("\n--- Request 1 (cost 3) ---");
    bucket.tryConsume(3); // OK: 5 -> 2

    // 2. Simulate time passing (refill)
    System.out.println("\n--- Tick 1 ---");
    bucket.refill(); // 2 -> 3

    // 3. Another request
    System.out.println("\n--- Request 2 (cost 2) ---");
    bucket.tryConsume(2); // OK: 3 -> 1

    // 4. Simulate time passing (refill)
    System.out.println("\n--- Tick 2 ---");
    bucket.refill(); // 1 -> 2

    // 5. Try to consume more than available
    System.out.println("\n--- Request 3 (cost 3) ---");
    bucket.tryConsume(3); // FAIL: 2 tokens available

    // 6. Simulate time passing (refill)
    System.out.println("\n--- Tick 3 ---");
    bucket.refill(); // 2 -> 3

    // 7. Try again with enough tokens
    System.out.println("\n--- Request 4 (cost 3) ---");
    bucket.tryConsume(3); // OK: 3 -> 0
  }
}

Why Choose Token Bucket?

The Token Bucket algorithm offers several compelling advantages, especially when compared to simpler methods:

Allows Bursts: It's perfect for APIs that expect occasional spikes in traffic.
Simple to Implement: The core logic is straightforward to code.
Smooth Average Rate: While allowing bursts, it still enforces a consistent average request rate over the long term.
Flexible: You can tune both the refill rate and bucket capacity to suit different use cases.

Common Use Cases

Token Bucket is widely used in various scenarios where controlled burstiness is desirable:

API Gateways: To protect backend services from sudden traffic surges.
Network Traffic Shaping: To smooth out data transmission and prevent network congestion.
Resource Management: Limiting access to shared resources in distributed systems.
Client-Side Rate Limiting: Implementing rate limits within client SDKs to prevent excessive requests.

Token Bucket Check

Let's test your understanding of the Token Bucket algorithm.

Token Bucket Summary

Great job! In this lesson, you've learned about the Token Bucket algorithm, a powerful rate-limiting method.

It uses a virtual bucket that accumulates tokens at a fixed rate.
Requests consume tokens, and if no tokens are available, requests are denied.
Its main strength is allowing controlled bursts of traffic, up to the bucket's capacity.

This flexibility makes it a popular choice for many real-world API and network applications.

Frequently asked questions

Is the “Token Bucket Algorithm Mechanics” lesson free?

Yes — the full text of “Token Bucket Algorithm Mechanics” is free to read here on the web, and the API Rate Limiting & Scalability Patterns course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the API Rate Limiting & Scalability Patterns course, upgrade to CoddyKit PRO.

What will I learn in “Token Bucket Algorithm Mechanics”?

Explore the token bucket algorithm, understanding its flexibility in allowing bursts and its common use cases in modern systems. You practise API Rate Limiting & Scalability Patterns with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start API Rate Limiting & Scalability Patterns?

No prior experience is required. API Rate Limiting & Scalability Patterns on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Token Bucket Algorithm Mechanics” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this API Rate Limiting & Scalability Patterns lesson?

Yes. Every API Rate Limiting & Scalability Patterns lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to API Rate Limiting & Scalability Patterns