how do u handle api rate limiting for external users

we're putting together some new public APIs and really need to put rate limiting in place, you know, to stop abuse and make sure everyone gets a fair shot. what are your usual approaches or libraries for this? do you have any favorite algorithms, like token bucket or leaky bucket? and how do you handle different limits for different API keys or user levels? just wondering what people have found works best in the real world.