API Rate Limiting: Per User or Per IP?

Hey everyone, I'm trying to figure out API rate limiting for a new service we're building. I'm stuck between tracking limits per user account or per IP address. Each way has its good and bad points, especially concerning security and making things fair. What have you all found works best, and what should I watch out for?