When should you actually put rate limiting in place, and how do you do it?

So, I've been thinking about rate limiting a bunch, particularly for APIs that everyone can use. It feels super important for stopping abuse and making sure things are fair, but getting it just right can be a real headache. What do you guys usually do to set up rate limiting? Do you track certain things, or have specific limits that work well for you? When did you realize your system actually needed rate limiting, and what tipped you off?