Rate limiting controls requests per identity, API key, IP, tenant, or resource. Common algorithms include fixed window, sliding window, token bucket, and leaky bucket. Token bucket permits controlled bursts while limiting long-term rate. In distributed deployments, counters may live in Redis or a gateway; account for atomic updates, clock behavior, fail-open versus fail-closed policy, and different limits for expensive endpoints.