Rate limits

Rate limits apply per authentication scheme - per API key on the Public API, per IP address on a handful of sensitive auth routes.

Public API (X-API-Key)

Every API key has its own per-minute limit - 60 requests/minute by default. Exceeding it returns 429 TOO_MANY_REQUESTS with the specific limit in the message. If your integration needs a higher limit, that's configurable per key - get in touch.

Auth routes (per IP)

A handful of routes an attacker would specifically want to hammer - login, registration, token refresh, social auth, and invite acceptance - are separately rate-limited per client IP, regardless of API key or JWT:

Handling a 429

Back off and retry after a short delay - these limits reset on a rolling per-minute window, not a fixed clock boundary. There's no Retry-After header today, so a fixed short backoff (a few seconds) is the safest default for automated retries.