Your API Rate Limiting Is Probably Wrong. Here Are the Patterns That Actually Work.

"Allow 100 requests per minute, then block." Sounds reasonable. Here is why it fails in production. A user sends 100 requests at 12:00:59 and 100 more at 12:01:01. They just sent 200 requests in 2 se