API Rate Limiter Designer

Rate limiting fails in two directions: too loose and one bad client takes down the database for everyone; too crude and you rate-limit your own legitimate power users into churn. This skill designs your rate limiting strategy end-to-end: the right algorithm for your use case (token bucket vs. sliding window vs. fixed window and why it matters), the right granularity (per IP, per user, per API key, per endpoint — not all the same), Redis implementation that doesn't add latency on every request, the response format that doesn't enrage developers, and the exemption system for your high-trust clients. It also covers the abuse patterns rate limiting doesn't stop, so you're not surprised when someone routes around it. Give it your API shape, your traffic patterns, and your abuse concerns; it returns a rate limiting design you can implement in a day.