Should we use rate limiting per IP address or per User ID, you know

Hey everyone, I'm trying to figure out the best way to do rate limiting for a new API. My main question is how specific we should get: should we strictly limit by IP address, or is it better to use a user ID once they're logged in? Limiting by IP seems easier at first, but it's not great if lots of people are sharing one IP address. Using a user ID sounds fairer for people who are logged in, but what about the parts of the API that don't require a login? Has anyone dealt with this before, or do you have any tips? I'm really curious to hear what works in practice.