Token-Based Rate Limiting for AI Endpoints in ASP.NET Core: A Real-World Walkthrough

The first AI endpoint I put behind a rate limiter was protected by a policy that allowed 60 requests per minute per user. It felt responsible. Two weeks later one customer generated a bill larger than