You should persist the auth token, rate limits are by IP. They also don’t exclude successful logins currently. This is a limitation in Lemmy. We have currently configured it to allow 5 logins per IP per day, but if you’re lucky you can exceed that, as the consumption is not synchronized between backends at this time.