when do you add rate limiting

hey everyone, i'm trying to figure out the best time to implement rate limiting on our APIs. we're a growing startup, and while we haven't had major abuse issues yet, i can see it becoming a problem as we scale. at what point did you guys start thinking about rate limiting? are there specific metrics or triggers you look for? curious about your experiences and best practices