api rate limiting: per ip or per user token

Hey everyone, I'm trying to figure out the best way to handle API rate limiting for a new service we're building. We're weighing two options: limiting by IP address versus limiting by authenticated user token. Limiting by IP feels easier to set up at first. But, it could cause problems for good users who share an IP, like people in an office or on public Wi-Fi. Limiting by token gives us more control and is fairer to each person, but we'd need solid authentication, and it might get tricky to handle as we grow. What have you all found works best? Any unexpected issues or good strategies for different situations?