How should API rate limiting be designed for production?

For production, choose the right partition key and algorithm, set limits per workload, return 429 when throttled, communicate retry guidance, and monitor rejected traffic before tuning thresholds. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.