How would you answer an interview scenario involving rate limiting and resilience in Web API?

A public API is overwhelmed by one client. Explain how you would rate-limit fairly without hurting all users.