In essence, these two options do the same: they limit the number of results a search can have (you can use it to paginate your searches too). The main difference comes from where this limit is applied.
If you add a limit of 8 on the API key, for example, a user can’t retrieve more than 8 results per search, even if you set the
hitsPerPage to 1000 for their searches. They will only get a maximum of 8 back, because their API key limits them.
If you define limits with the
hitsPerPage parameter, a user could theoretically alter the search call to Algolia’s server to include 1000 results (the maximum) instead of the limit of 8 you’ve set. Because the limit is not on the API key but based on the
hitsPerPage parameter, the number of results Algolia shows per search depends on what request Algolia receives, and since this search is performed from the front end, a technically savvy user could make changes to the call to receive more results.
I hope this clarifies the difference, let me know if you have any other questions!