Too Long; Didn't Read
In the API economy, the APIs are the shared resource for all your customers. Not all APIs and it’s callers are the same, but not all APIs are called by a variety of actors. API rate-limiting choices are dictated by multiple factors unlike for TCP, however the basic premise still remains the same - use a clock to count and limit access to a shared resource. We map “what do you count” to a token? Counting is then performed using redisate a new granularity can be found in the article on the actual code.