so, when it comes to API rate limiting, we've got a few different strategies.

were starting to see some users hitting our APIs pretty hard, and I want to get ahead of potential issues. were considering implementing rate limiting, but im curious about different approaches. are you guys using token buckets, leaky buckets, fixed windows, or something else? whats the pros and cons youve seen in practice, especially regarding user experience versus system stability?