Core concepts
Rate limits
Per-IP throttling, the global window and the stricter auth limits.
The API is rate limited per client IP address. When you exceed a limit, the request is rejected with 429 Too Many Requests; wait for the window to reset and retry.
Global limit
By default every endpoint shares a global limit of 100 requests per 60-second window, per IP. This is generous for normal integration traffic; batch large jobs rather than bursting.
Stricter limits on authentication
Sensitive authentication endpoints have their own, much tighter limits to resist brute-force and abuse. These apply in addition to the global limit and are also counted per IP over the same 60-second window.
| Endpoint | Limit (per minute) |
|---|---|
POST /auth/login | 5 |
POST /auth/trial-signup | 3 |
POST /auth/forgot-password | 3 |
POST /auth/reset-password | 5 |
POST /auth/verify-otp | 10 |
POST /auth/resend-otp | 3 |
POST /auth/change-password | 5 |
POST /auth/phone-otp/start | 3 |
POST /auth/phone-otp/verify | 10 |
The 429 response
A throttled request returns the standard error envelope with status 429:
{
"statusCode": 429,
"message": "ThrottlerException: Too Many Requests",
"requestId": "req_...",
"timestamp": "2026-09-06T09:00:00.000Z",
"path": "/api/v1/auth/login"
}Handle 429 with backoff
429, pause and retry after the 60-second window elapses, ideally with exponential backoff. Attaching an Idempotency-Key to writes (see making requests) makes those retries safe against duplication.Limits are keyed on the real client IP