API Rate Limiting: Token Bucket Defense

Rate limiting is one of the most common security controls on a real web application — it is what stops brute-force login attempts, credential stuffing and scraping bots from overwhelming an API. This simulator renders the token-bucket algorithm in 3D: a glowing bucket holds a pool of tokens that refill at a fixed rate, an incoming stream of requests flies in from the client side, and each one is only let through to the server if a token is available at that instant. Tune the request rate, the refill rate and the bucket's capacity to see the exact trade-off every production rate limiter makes between absorbing legitimate bursts and blocking sustained abuse, fire a simulated burst attack to watch the bucket drain and 429 responses start firing, and read the live token level, accept/reject counts and rejection rate as the system runs.