In a cursory glance, this appears to be logic (token, redis, etc) that can be handled by Nginx+Lua. Is there any reason to do it this way vs the other?
Using Lua is certainly easier. The C version will almost always be faster, and yes, performance in this scenario probably wouldn't be an issue between the two. The other reason for writing a module in C though is complete control over the execution and an easier time troubleshooting problems. Adding another language layer can present issues when things explode.