What is a common mistake when working with API rate limiting?

A common mistake with API rate limiting is one global limit for every client and endpoint can punish legitimate users while still failing to protect an expensive hotspot. The safer approach is to design and test the behavior explicitly rather than assuming the platform or dependency will handle it automatically.