How difficult is it to rate limit API requests? Just Fibonacci the increasing slowdown.
And require something like a public key to access the API so you can track requests coming from multiple hosts.
Then any rate of access above that of a power user can be charged for appropriately. And make it so that activating API access is something that can't be automated so people can't create thousands of API dummy accounts.
The problem here is that many users are behind CGNAT, meaning many end users share a single IPv4. Unfortunately the days of counting distinct users by their IP(v4) are over.
And require something like a public key to access the API so you can track requests coming from multiple hosts.
Then any rate of access above that of a power user can be charged for appropriately. And make it so that activating API access is something that can't be automated so people can't create thousands of API dummy accounts.