Rate limiting protects your system from abuse and traffic spikes (often returning HTTP 429). You can enforce it at the edge (CDN/WAF), API gateway/load balancer, and in the app itself. Earlier enforcement saves resources, but the app still needs safeguards because not all traffic comes through one entry point.