I emailed them about this:

The limit is measured per IP address and per account. So for one account (regardless of the number of key/secret pairs) 60 requests per minute can be made via our API. When you are using multiple connections (IP addresses), the combined sum of all request for the account in question will used to determine if you are below the 60/minute limit.

We hope this response has sufficiently answered your questions.

My finding for bitfinex rate limit is this: 1 second is divided up in milliseconds. 60 requests must span the entire second.

For example, if you have a foreach loop you'll get a rate limit error in less than 15 requests, because you are querying too fast. So add usleep (microsecond sleep in PHP) to span your requests for the entire second and or have multiple IP's assigned to your VPS or dedicated box and use this curl option.

  <?php
  $ips = array('1.1.1.1','1.1.1.2','1.1.1.3');

  curl_setopt($ch, CURLOPT_INTERFACE, $ips[array_rand($ips)]);

I tried to comment on the other answer, but my rep isn't high enough. I wanted to point out that Nick's presumption about using the counter makes sense but doesn't answer the question, which, assuming his presumption is correct, leaves this unanswered: When is the counter reset?

I would implement it this way, and (to be safe) assume that this is how they did it: On each request, if the number of requests matching either your account or your IP (or both) in the last 60 seconds is over 60, then the request is denied. This means that one of the "60 requests at once during the first second of the second minute" would get answered and the rest would fail. There would be no counter, but instead a record of all requests (IP, account, timestamp) that is purged of records over a minute old as often as necessary to keep the server healthy.