# How to Configure Leaky Bucket, GCRA, and Exponential Rate Limiters

DevFeed: [How to Configure Leaky Bucket, GCRA, and Exponential Rate Limiters](<https://devfeed.tech/articles/a-few-notes-on-ratelimiting-36223.md>)

Original publisher: [Read original article](<https://dotat.at/@/2025-09-14-ratelimit.html>)

Published: 2025-09-14T03:30:44Z

Content type: tutorial

Language: en

Sources: [Tony Finch's blog](<https://devfeed.tech/sources/tony-finch-s-blog.md>)

Topics: [rate-limiting](<https://devfeed.tech/topics/rate-limiting.md>), [client](<https://devfeed.tech/topics/client.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [email](<https://devfeed.tech/topics/email.md>), [Server](<https://devfeed.tech/topics/server.md>)

Tags: [client](<https://devfeed.tech/tags/client.md>), [email](<https://devfeed.tech/tags/email.md>), [http](<https://devfeed.tech/tags/http.md>), [rate-limiting](<https://devfeed.tech/tags/rate-limiting.md>), [servers](<https://devfeed.tech/tags/servers.md>)

## AI overview

This article explains how to configure leaky bucket, GCRA, and exponential rate limiters using a limit and a period. It describes average rates, burst sizes, forgetting behavior, and an email-server example for detecting spam.

## Source excerpt

Last year I wrote a pair of articles about ratelimiting: GCRA: leaky buckets without the buckets exponential rate limiting Recently, Chris "cks" Siebenmann has been working on ratelimiting HTTP bots that are hammering his blog. His articles prompted me to write some clarifications, plus a few practical anecdotes about ratelimiting email. mea culpa The main reason I wrote the GCRA article was to explain GCRA better without the standard obfuscatory terminology, and to compare GCRA with a non-stupid version of the leaky bucket algorithm. It wasn't written with my old exponential ratelimiting in mind, so I didn't match up the vocabulary. In the exponential ratelimiting article I tried to explain how the different terms correspond to the same ideas, but I botched it by trying to be too abstract. So let's try again. parameters It's simplest to configure these ratelimiters (leaky bucket, GCRA, exponential) with two parameters: limit period The maximum permitted average rate is calculated from these parameters by dividing them: rate = limit / period The period is the time over which client behaviour is averaged, which is also how long it takes for the ratelimiter to forget past behaviour. In my GCRA article I called it the window. Linear ratelimiters (leaky bucket and GCRA) are 100% forgetful after one period; the exponential ratelimiter is 67% forgetful. The limit does double duty: as well as setting the maximum average rate (measured in requests per period) it sets the maximum size (measured in requests) of a fast burst of requests following a sufficiently long quiet gap. how bursty You can increase or decrease the burst limit - while keeping the average rate limit the same - by increasing or decreasing both the limit and the period. For example, I might set limit = 600 requests per period = 1 hour. If I want to allow the same average rate, but with a smaller burst size, I might set limit = 10 requests per period = 1 minute. anecdote When I was looking after email servers