How would you design rate limiting for a public API?

Technical