Rate Limiting
Rate limits are applied per client IP address:
| Scope |
Limit |
| All authenticated endpoints |
3000 requests per minute (burst 200) |
POST /auth/login |
5 requests per minute |
PUT /auth/password |
3 requests per minute |
POST /auth/refresh |
30 requests per minute (burst 15) |
When rate-limited, the server responds with 429 Too Many Requests and includes a Retry-After: 60 header.