Engineering Decisions · Senior · Question 13 of 14
A public API runs on 40 instances, and each key may make 100 requests per minute. Small bursts are fine, but the limit must hold across instances. Where do the counters live?
- 1In the memory of each of the 40 instances
- 2In a PostgreSQL row updated on each request
- 3In a shared Redis, using a token bucket
Show the answer
Correct answer: In a shared Redis, using a token bucket
Explanation
A shared in-memory store sees all instances and handles this rate of updates cheaply, and a token bucket allows short bursts. Per-instance counters fit rough protection against floods, but a key could reach 40 times its limit. A database row fits low-volume quotas such as monthly billing, while updating it on every request turns one row into a hot bottleneck.