Rate Limiting Not Working

I'm building a website in Nuxt and Vue.
I have rate limiting enabled and values set within my Supabase project, yet it doesn't seem to enforce them.
I've tried this across multiple projects and end up with the same outcome.
While I use my own backend API endpoints to call Supabase, if the user has my project URL they can bypass these protections.

I am making the request to POST /auth/v1/token?grant_type=password and can send unlimited requests without being rate limited.
Does any one have any ideas on why this is happening, or how to resolve it before we go to prod?
Was this page helpful?