A limit protects a scarce resource. State whose requests share the limit, how much burst you allow, and whether rejected work should retry. A login endpoint may need an account limit and an IP limit; a shared office can put many legitimate users behind one address. Choosing only the address can block the whole office.
Token buckets allow a bounded burst while refilling at a steady rate. A fixed window is easy to count but can admit two windows of traffic at their boundary. Distributed application servers need a shared decision or a documented approximation; separate in-memory counters multiply the quota. Build the limiter where all requests cross it, and define what happens when its counter store is unavailable.