Using a Lua script for refill, validation, and token consumption is the key step here. Without atomic execution, concurrent clients can read the same token count and both succeed, allowing the real request rate to exceed the configured limit.