In a nutshell
Rate limiting caps how fast a client can make requests so one user can't overwhelm a service. The token-bucket method holds a fixed number of tokens that refill at a steady rate; each request spends one. A full bucket lets a short burst through instantly, then requests are throttled to the refill rate, and once it's empty extra requests are rejected.