Design the rate limiter in front of a busy API platform. Every incoming call is checked first: count it against its key's current window and answer allow or throttle. A dashboard endpoint reads a key's current usage back out.
The check runs before every single request the platform serves.