How do you implement rate limiting on the backend?

Backend rate limiting protects services from abuse and overload. **Where to enforce:** API gateway, load balancer, or app layer. **Common algorithms:** token bucket, sliding window. **Distributed enforcement:** use Redis for counters/buckets (atomic updates) or a gateway that supports distributed limits. Always return clear errors (429) and consider per-user vs per-IP limits.