API Gateway Token-Bucket Rate Limiter (2D)

This 2D companion drives the same token-bucket rate-limiting model as the 3D version through a flat three-lane diagram built for reading the mechanics rather than orbiting a scene: clients on the left fire legitimate logins and, when you launch it, a credential-stuffing burst; a gateway lane in the middle shows the bucket's token level as a fill bar that drains on every admitted request and refills at a fixed rate; and a backend lane on the right shows server health degrading — and legitimate logins starting to fail alongside the attack traffic — once admitted load exceeds capacity. Toggling "No protection" vs. "Token bucket" with the attack running makes the trade-off directly visible: unprotected, the backend saturates and even real users get rejected; rate-limited, the attack is throttled at the gateway and legitimate-login success stays high.