api rate limiting, should it be per user or per ip

hey all, i'm wrestling with api rate limiting for a new service. we've got a lot of users behind shared ips, like corporate networks or public wifi. if we limit strictly by ip, we risk unfairly throttling legitimate users. but limiting purely by user id could be tricky for unauthenticated requests or bots trying to abuse the system. what are your experiences and preferred strategies for balancing this? do you use a hybrid approach? what tools or libraries have you found effective for this