I think I’ve found the answer here: https://shopify.dev/api/storefront#rate_limits
If you use a server-side library, the IP address of the request will be your server’s address. To ensure your app is throttled correctly, use a delegate access token and pass it in the Shopify-Storefront-Private-Token header from server contexts. Requests using this authentication method can pass the buyer IP into the Shopify-Storefront-Buyer-IP header.