Design an API rate limiter. Approaches: (1) Token bucket algorithm (most flexible), (2) Fixed window counter (simplest, but burst at boundary), (3) Sliding window log (accurate but memory-heavy), (4) Sliding window counter (hybrid, good balance). Implement token bucket in code. Discuss: where to store counters (Redis), distributed rate limiting, returning 429 with Retry-After header.
