What do you usually use for API rate limiting?

So, I'm wondering how you all deal with rate limiting for your APIs? We're putting together a new microservices setup and want to be sure we aren't overloading other services or getting hammered by bots. Are you guys using a separate tool for this, building it into your API Gateway, or maybe something else? What's worked out for you, and what hasn't?