so like when do you actually put rate limiting in place, you know

i've been thinking a lot about protecting backend services from abuse and overload. rate limiting seems like a key strategy for this, but i'm wondering about the specific points where it becomes essential. is it usually implemented at the api gateway, or do individual services need their own rate limiting logic? what are the trade-offs between different approaches, like token bucket vs. leaky bucket? curious to hear what others have found effective in practice