Start here. This is the direct spoken answer to practice first.
Why this question matters
A timeout is a capacity boundary as well as a latency choice. It limits how long a slow dependency can retain request, connection, and concurrency resources.
I set explicit timeouts for database, cache, and outbound HTTP work so one stalled dependency cannot hold an API request indefinitely. Each timeout must fit inside the endpoint's overall response budget and leave time to handle failure. I also propagate the request cancellation token, but cancellation and timeout are different: the caller can leave early while the server's dependency budget can expire even when the caller stays connected. A timeout does not prove that a remote write failed, because its outcome may be unknown.