Token bucket algorithm in Rest API - Step-by-Step Execution

Concept Flow - Token bucket algorithm

Start

↓

Tokens added at fixed rate

↓

Request arrives

↓

Check if tokens >= request cost?

No→Reject request

Yes↓

Consume tokens

↓

Allow request

↓

Wait for next request or token refill

↓

Request arrives

Tokens are added steadily. Each request uses tokens if enough are available; otherwise, it is rejected.

Execution Sample

Rest API

bucket_capacity = 5
tokens = 5
refill_rate = 1  # tokens per second

# Request costs 2 tokens
if tokens >= 2:
    tokens -= 2  # consume tokens
    allow_request = True
else:
    allow_request = False

This code checks if there are enough tokens for a request costing 2 tokens, consumes them if possible, and decides to allow or reject the request.

Execution Table

Step	Time (s)	Tokens Before	Request Cost	Tokens After	Request Allowed
1	0	5	2	3	Yes
2	1	4	3	1	Yes
3	2	3	4	3	No
4	3	4	1	3	Yes
5	4	4	5	4	No
6	5	5	2	3	Yes

💡 Simulation ends after 6 requests processed with token refills each second.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5	After Step 6
tokens	5	3	1	3	3	4	3
allow_request	N/A	Yes	Yes	No	Yes	No	Yes

Key Moments - 3 Insights

Why does the token count increase by 1 before each request?

Tokens are refilled at a fixed rate (1 token per second) before processing each request, as shown in the 'Tokens Before' column in the execution_table.

Why is the request rejected at step 3 even though tokens are available?

At step 3, tokens before request are 3 but request cost is 4, which is more than available tokens, so the request is rejected (see execution_table row 3).

Why does the token count never exceed the bucket capacity?

Tokens refill only up to the bucket capacity (5 tokens). The execution_table shows tokens never go above 5, ensuring the bucket limit is respected.

Visual Quiz - 3 Questions

Look at the execution_table, what is the token count after step 2?

A 4

B 1

C 3

D 2

💡 Hint

Check the 'Tokens After' column in row 2 of the execution_table.

At which step is a request rejected due to insufficient tokens?

A Step 3

B Step 1

C Step 4

D Step 6

💡 Hint

Look for 'No' in the 'Request Allowed' column in the execution_table.

If the refill rate was 2 tokens per second, how would tokens before step 3 change?

A It would be 5

B It would be 3

C It would be 4

D It would be 2

💡 Hint

Tokens refill faster but cannot exceed bucket capacity (5 tokens). Check variable_tracker for token limits.

Concept Snapshot

Token bucket algorithm:
- Tokens added steadily at fixed rate
- Bucket has max capacity
- Each request costs tokens
- If enough tokens, consume and allow
- Else, reject request
- Controls request rate smoothly

Full Transcript

The token bucket algorithm controls how many requests can be processed over time. Tokens are added to a bucket at a steady rate, up to a maximum capacity. Each incoming request needs some tokens. If the bucket has enough tokens, the request is allowed and tokens are consumed. If not, the request is rejected. This way, bursts of requests can be handled smoothly without exceeding limits. The execution table shows tokens before and after each request, whether the request is allowed, and how tokens refill over time.

Practice

1.

What is the main purpose of the token bucket algorithm in REST APIs?

easy

A. To encrypt API responses

B. To store user data securely

C. To control the rate of incoming requests by using tokens

D. To manage database connections

Solution

1. Step 1: Understand the token bucket algorithm concept

   The token bucket algorithm limits how many requests can be processed by controlling tokens that refill over time.

2. Step 2: Identify the purpose in REST APIs

   It helps prevent too many requests at once, protecting the server from overload.

3. Final Answer:

   To control the rate of incoming requests by using tokens -> Option C

4. Quick Check:

   Token bucket controls request rate = C [OK]

Hint: Token bucket limits request rate using tokens [OK]

Common Mistakes:

• Confusing token bucket with data storage
• Thinking it encrypts data
• Assuming it manages database connections

2.

Which of the following is the correct way to represent a token bucket refill rate in pseudocode?

1. refill_rate = tokens_per_second
2. refill_rate = seconds_per_token
3. refill_rate = max_tokens * time
4. refill_rate = tokens / max_tokens

easy

A. refill_rate = seconds_per_token

B. refill_rate = tokens_per_second

C. refill_rate = max_tokens * time

D. refill_rate = tokens / max_tokens

Solution

1. Step 1: Understand refill rate meaning

   The refill rate is how many tokens are added per second to the bucket.

2. Step 2: Match with options

   refill_rate = tokens_per_second correctly shows tokens added per second, which is the refill rate.

3. Final Answer:

   refill_rate = tokens_per_second -> Option B

4. Quick Check:

   Refill rate = tokens per second [OK]

Hint: Refill rate means tokens added each second [OK]

Common Mistakes:

• Confusing refill rate with time per token
• Multiplying max tokens by time incorrectly
• Using ratios instead of rates

3.

Given a token bucket with max_tokens = 5, refill_rate = 1 token/second, and an empty bucket at time 0, what is the number of tokens available at time 3 seconds?

medium

A. 3 tokens

B. 5 tokens

C. 0 tokens

D. 1 token

Solution

1. Step 1: Calculate tokens refilled after 3 seconds

   Since refill rate is 1 token per second, after 3 seconds, 3 tokens are added.

2. Step 2: Check max tokens limit

   The bucket max is 5 tokens, so 3 tokens fit without exceeding the max.

3. Final Answer:

   3 tokens -> Option A

4. Quick Check:

   3 seconds * 1 token/sec = 3 tokens [OK]

Hint: Multiply seconds by refill rate, cap at max tokens [OK]

Common Mistakes:

• Assuming bucket fills instantly to max
• Ignoring max token limit
• Using refill rate incorrectly

4.

Consider this pseudocode snippet for token bucket check:
if tokens <= 0:
  reject_request()
else:
  tokens -= 1
  allow_request()
What is the bug in this logic?

medium

A. It should check if tokens > 0 before allowing

B. It should increase tokens instead of decreasing

C. It should reject when tokens > 0

D. It should check if tokens < 1, not <= 0

Solution

1. Step 1: Recall proper token bucket logic

   To consume 1 token, check if tokens >= 1 before decrementing (equivalent to reject if tokens < 1).

2. Step 2: Identify the bug

   The code rejects only if tokens <= 0. For fractional tokens (common in real implementations), if 0 < tokens < 1, it allows the request, decrementing to negative, which is incorrect.

3. Final Answer:

   It should check if tokens < 1, not <= 0 -> Option D

4. Quick Check:

   Reject if tokens < 1 [OK]

Hint: Allow only if tokens >= 1 [OK]

Common Mistakes:

• Using <= 0 instead of < 1 causes off-by-one errors
• Increasing tokens on request instead of decreasing
• Rejecting requests when tokens are available

5.

You want to implement a token bucket that allows bursts of up to 10 requests and refills tokens at 2 tokens per second. If a client sends 15 requests instantly after being idle for 3 seconds, how many requests will be allowed immediately?

hard

A. 6 requests

B. 5 requests

C. 15 requests

D. 10 requests

Solution

1. Step 1: Calculate tokens available after 3 seconds idle

   Refill rate is 2 tokens/second, so after 3 seconds: 2 * 3 = 6 tokens. Max tokens allowed is 10, so bucket fills to 6 tokens.

2. Step 2: Consider burst capacity

   Since the bucket max is 10, if it was full before idle, it would have 10 tokens. But starting empty, after 3 seconds it has 6 tokens.

3. Step 3: Determine allowed requests

   The client sends 15 requests instantly, but only 6 tokens are available, so only 6 requests allowed immediately.

4. Final Answer:

   6 requests -> Option A

5. Quick Check:

   3 sec * 2 tokens/sec = 6 tokens available [OK]

Hint: Tokens = min(max_tokens, refill_rate * idle_time) [OK]

Common Mistakes:

• Assuming bucket always full at max tokens
• Allowing more requests than tokens available
• Ignoring refill rate and idle time