Rate limiting must be applied at the user level rather than the key level; otherwise users can bypass the limit by continuously creating new keys.