How do you handle rate limiting for APIs?

we're building out a few public APIs and need to implement rate limiting to prevent abuse and ensure fair usage. i've seen a few approaches like token buckets and leaky buckets, but im curious about how others are implementing this in practice. are you using a library, a dedicated service, or building it yourself? what are your go-to strategies for setting limits (per user, per IP, per API key)? looking for real-world experiences and tips.