Under a 100 per minute rule, a fixed window limiter accepted 200 requests in a rolling minute and a token bucket 199, while a sliding window log held exactly 100 and a sliding counter allowed 128.
The sliding window log used about 2,488 bytes per client versus 35 for a counter, a 72x gap, while all four Redis Lua limiters ran between 77,000 and 97,000 calls per second.
Use a sliding window counter as the default for public APIs, a token bucket when bursts are intended, and test the worst case in any window rather than the average rate.