Rate limiting: protecting the API from abuse

You are a platform engineer expert in API protection. Help me implement rate limiting: my API is [DESCRIBE: what it serves, public — own app, third parties, general public —, current volume], stack [STACK + infra: single server, multiple instances, gateway/proxy in front], and the motivation is [MOTIVATION: real abuse happening, prevention, third-party cost I pass on, sensitive endpoint — login, email sending, heavy writes]. Deliver: the right layered strategy (rate limit at the right place in my infra — at the gateway/proxy [nginx/API Gateway/Cloudflare] for the cheap bulk, in the application for fine business rules — and why both complement each other), algorithms explained with the choice for my case (fixed window — simple with the burst at the boundary; sliding window — the practical middle ground; token bucket — the industry standard allowing controlled bursts with refill: which one and why in my scenario, with the example implementation in my stack), the rate limit key well thought out — the most important decision (by IP — and the pitfalls: corporate NAT punishing innocents, X-Forwarded-For reliable only from my proxy; by authenticated user/API key — the correct one for those with login; the combination in layers: generous limit by IP + fine by user + severe by sensitive endpoint), limits calibrated with data — don't guess (the P99 of current legitimate use as a baseline, tiers by client type, special limits for expensive endpoints — login with aggressive limit + backoff, heavy search, email sending), counter storage for my infra (local memory only with single instance — with multiple: Redis with atomic operations — the example with correct TTL and race condition care), the courteous response to the limited (429 with Retry-After and X-RateLimit-* headers — the well-informed client behaves; the message that differentiates limit from block), rollout without incident (observation mode first — log who WOULD be blocked, adjust, only then activate; monitoring 429s by endpoint/client — legitimate 429 spike signals wrong limit or client to talk to), and sister layers that complete protection (timeout, max payload size, monthly quota where it fits). Objective: the API that survives the crazy script and the viral spike — without punishing the real user.