How would you design a distributed rate limiter?

Algorithms: Token Bucket (tokens replenish at rate, request consumes token), Leaky Bucket (fixed output rate, queue excess), Sliding Window (count requests in rolling window). Distributed: centralized counter (Redis INCR with TTL) or local with sync. Challenges: clock synchronization, race conditions (Lua scripts for atomicity), hot partitions. Architecture: embedded in service, API gateway, or standalone service. Features: per-user, per-API, burst handling, graduated limits. Response: 429 Too Many Requests, Retry-After header, X-RateLimit headers. Accuracy vs performance trade-off.