API rate limiter

Design a basic rate limiter for a single public API endpoint so no client can call it more than 100 times per minute. Clients are identified by API key. The API runs on a couple of server instances behind a load balancer. Describe how you count requests and decide when to reject (return 429).