How should rate limiting and resilience be designed for production in Web API?

Use appropriate partition keys, return 429 with retry guidance, combine with timeouts and circuit breakers, and observe rejected traffic.