Rate Limiting in Practice

Two questions are left. Where in the system does the limiter run, and what does it tell the client when it says no?

Where the limiter sits

At the edge, in the API gateway. This is the common answer. Every request already passes through the gateway, the gateway already knows the identity of the caller, and one limiter there protects every service behind it. Excess traffic is rejected before it reaches anything expensive.

Inside a service. A single endpoint may need its own rule that the edge cannot express, usually because the cost of the request depends on what is in it