Securing RESTful APIs with Token Bucket Rate Limiting and APCu

Protecting API endpoints from brute force attacks and excessive requests is non-negotiable for system developers. The standard approaches often burden a relational database or require a Redis cluster that adds operational costs.

By using the Token Bucket algorithm implemented in local APCu (Alternative PHP Cache) memory, quota checks finish in microseconds with no cross-server network overhead at all.

This article walks through configuring bucket capacity, the token refill rate per second, and a strategy for periodic synchronization to a persistent MySQL table to guarantee consistency across PHP-FPM workers.

Test results show the architecture can reject traffic spikes of tens of thousands of requests per second with very predictable memory usage.