Which design keeps one authenticated user's quota consistent across four API instances?

Which design keeps one authenticated user's quota consistent across four API instances?

1. Atomically update a subject-keyed counter or bucket in shared storage
2. Give every process its own in-memory counter with the full quota
3. Trust the first X-Forwarded-For value supplied by any client