A token bucket protects a service from more traffic than it can take. It holds up to a fixed number of tokens and refills at a steady rate; each request spends a token, and a request that finds the bucket empty is turned away. Short bursts get through at once, but the long-run rate is capped.