Depends on the attack you want to generate(Attack type), the capacity of your single host (CPU, Memory), and on the network capacity (Bandwidth), and also on the application that is receiving the requests in the case is a L7 attack, and probably more variables to take into consideration.
tl/dr: Client authentication in the browser is useless because browser-based bots will automatically authenticate themselves, and
browser-less bots will get stopped by much simpler methods anyway.
This isn't really a surprise, because "client authentication" isn't
really effective for browsers (and is only slightly effective for other "kinds" of ...