Key it on the client IP and you are trusting a header the caller sets. Anyone rotating that value gets a fresh budget every request, so the limit stops accidents and not attempts. Key it on an authenticated user id and it holds, but that only works after login, which is not where brute force happens.
So an unauthenticated endpoint that costs money needs a second limit keyed on nothing at all: a ceiling on the whole instance that no request can influence. It drops legitimate traffic under a flood, which is the right trade when the alternative is an unbounded bill.
Updated August 2026