You need to rate-limit an API both per-user and per-IP, at scale, across multiple instances. How do you implement it?

Tests whether you know why a distributed counter (like Redis-backed) is needed instead of an in-memory counter on each instance.