Should we limit things per user, or per IP address?

were trying to implement rate limiting for our api to prevent abuse and ensure fair usage. im debating whether to focus on limiting requests per individual user account or per ip address. each has its pros and cons. limiting by user is great for individual accountability, but what about shared ips or users behind a proxy? ip-based limiting is simpler to implement across the board, but a single abusive ip could impact many legitimate users. what strategies are you using for api rate limiting, and what have you found to be most effective in practice?