Rate Limiting Design

Design rate limiting for {{api}} to protect against {{threat}}. Recommend the algorithm (token bucket, sliding window), the limits per user or key, how to handle bursts fairly, the response and headers to return when limited, how to scale it across instances, and how to avoid blocking legitimate traffic. Note how to communicate limits to API consumers clearly.