Embodiments are directed to controlling bandwidth usage using a token-based crediting and debiting scheme and to allowing connections to temporarily exceed bandwidth allocations using token credits. In one scenario, a bandwidth managing service receives a request to establish a connection with a network. The connection is associated with various subscribers that are part of a subscription. The bandwidth managing service assigns tokens to the connection, which are distributed from a pool of tokens that represents a total available bandwidth for the network. The bandwidth managing service receives a data transfer request from a logical user to transfer data over the network connection, where the data transfer request includes at least some of the assigned tokens. The bandwidth managing service also allocates to the connection a specified amount of bandwidth commensurate with the number of assigned tokens provided in the data transfer request.