If you provide an API client that doesn't include rate limiting, you don't really have an API client. You've got an exception generator with a remote timer.
Take a popular open-source project with a good test suite, delete a class, and re-implement the class using only the tests as a guide. Then, compare and contrast our implementation with the original!