Construction of a request limiting system

Develop a traffic limiting mechanism that meets the following requirements:

1. Limits requests to the API (e.g., REST or gRPC).
2. Prioritized restriction by IP address with the possibility of further extension (e.g., by token or user identifier).
3. Expected load – about 1 million active users per day.
4. Must withstand traffic spikes.
5. Architecture should be distributed.
6. Limitation check should occur with minimal delay.
7. Ensure fault tolerance.
8. When the limit is exceeded, return a clear error message. Goal – reduce the number of HTTP requests to the service and protect the system from DDoS attacks and overload.