The API request Rate Limit is based on user id or API KEY ?