How would you design a rate-limiting service for an external API that handles thousands of requests per second?