The issue with fixed window rate limiting when you have a very short window is that you can’t allow for bursts. It’s normal for most legitimate users of an API to have brief windows of time where they submit lots of requests, before returning to their normal levels. Token bucket rate limiting allows for these bursts, without having to effectively widen the window.