With correct Denial of Service protection, it is impossible to brute force authentication mechanisms other than password, so these three attacks are only applicable to passwords:
[ ] Brute force - password validation should get slower for each failure, until some a turing test is required.
[ ] Credential stuffing - Testing email addresses or passwords that are obtained from known breaches of other services.
[ ] Password spraying - Testing a single weak password against a large number of different accounts.
With correct Denial of Service protection, it is impossible to brute force authentication mechanisms other than password, so these three attacks are only applicable to passwords: