A public API must limit abusive traffic. Which design is appropriate?

1. Apply supported rate limits and monitoring, while protecting backend capacity and authorization.
2. Increase the backend's timeout without any request bound.
3. Assume rate limiting makes every request authorized.
4. Store all API keys in a public error page.