Rate limits
The gateway enforces sliding-window limits (rateLimitAllow). When exceeded, responses are 429 with success: false and message: rate_limited. Edge (e.g. Cloud Armor) may add further throttling on api.* hosts.
Buckets
| Bucket | Limit | Window | Applies |
|---|---|---|---|
| public-api-global:<ip> | 400 | 60s | Every /api/v1/* after routing succeeds |
| register:<ip> | 20 | 60s | POST /auth/register/user |
| api-key-session:<ip> | 120 | 60s | POST /auth/session/api-key |
| API key resolve | 120 / IP; 400 / key-hash prefix | 60s | During Bearer API-key resolution |
Best practices
- Back off on
429; avoid tight retry loops. - Prefer webhooks for push events instead of polling where possible.