Why do web APIs tend to use pre-shared keys for client auth instead of pubkeys?

Why don't APIs support IP address authentication?

For APIs focused on server based apps, this should work as well as anything else.

It's not possible to duplicate an IP --- the communication gets broken. If the server gets compromised --- well, any pre-shared keys are likewise compromised so the result is the same.

There are a few services that support this but not very many.