How would you design rate limiting for a public API?

Start with clarifying questions: limit by whom (IP, API key, user), at what level, hard block or slow down, and does the system run on one server or many.

Common algorithms:

• Fixed window: count per one-minute window; simple, but requests pile up at the window edges.
• Sliding window: smoother, uses more memory.
• Token bucket: allows short bursts; the most common choice for APIs.

With several servers, the counter has to live somewhere shared, such as Redis with atomic operations. Return 429 Too Many Requests with a Retry-After header, and log it so you can spot abuse.

At senior level, also talk about the trade-offs: accuracy versus cost, what to do when Redis fails (let everything through or block everything), and different limits for each customer plan.