Rate Limiting

Request limits enforced at the gateway

Rate limiting is enforced once, centrally, at api-gateway — individual backend services don’t apply their own limits.

Bucket	Limit	Applies to
auth	10 requests / minute per client	Everything under /v1/auth/*
default	100 requests / minute per client	Every other route

Limits are tracked per client (by IP) over a rolling 60-second window.

Exceeding the limit

A throttled request receives:

HTTP/1.1 429 Too Many Requests

{
  "success": false,
  "statusCode": 429,
  "message": "ThrottlerException: Too Many Requests"
}

Back off and retry after a short delay. There’s currently no Retry-After header — treat a 429 as “wait at least a few seconds,” particularly on the stricter auth bucket, which is intentionally tight to slow down credential-stuffing and OTP brute-forcing.

Timeouts

Independent of rate limiting, every request through the gateway has a 10 second server-side timeout. A request that doesn’t complete in time gets a 408 Request Timeout ({"success": false, "statusCode": 408, "message": "Request timed out"}) rather than hanging indefinitely — design clients to handle this the same way as any other transient failure.