Skip to main content
Every request is rate-limited by an in-memory sliding-window counter — no external dependency (no Redis, no slowapi). Limits are per caller identity, not global:
  • Authenticated calls are keyed by a hash of the Bearer token (API key, session, or master key).
  • Unauthenticated calls (before any credential is known to be valid, e.g. a login attempt) are keyed by source IP.
This means one noisy caller can’t exhaust another caller’s quota, and an unauthenticated brute-force attempt against /v1/auth/login is throttled per-IP even before it ever presents a valid credential.

​
Limits

The auth tier is intentionally tighter — these are the endpoints someone would actually try to brute-force (login) or spam (registration).

​
Response when limited

A 429 with a structured body and a standard Retry-After header (seconds until the window frees up):
Same error envelope as every other error in this API.
Single-process only. Counters live in this process’s memory. If this API ever runs with multiple uvicorn workers or multiple replicas behind a load balancer, each process keeps its own counters — the effective limit multiplies by however many processes are running. Fine for a single-instance deployment (e.g. one Railway service); move to a shared store (Redis) first if you scale horizontally.