Design a rate limiter for an API.

Where: API gateway or middleware; key by user ID, API key or IP.
Algorithms: token bucket (allows bursts), leaky bucket (smooth), fixed window (simple, edge spikes), sliding window (accurate).
Shared counters in Redis with atomic operations (INCR + EXPIRE, or a Lua script).
Response: 429 + Retry-After and remaining-quota headers.
If Redis is down: fail open (allow) or fail closed (block)? Decide per endpoint.
Several tiers (per second and per day), per-endpoint limits, a local in-memory pre-check to reduce Redis load.