Rate Limits
Requests are limited with a sliding window (Redis-backed in production).
Global tiers (defaults)
| Tier | Default | Applies to |
|---|---|---|
| Auth | 10 / 60s | Sign-in and related auth paths |
| Write (unauthenticated) | 60 / 60s | Unauthenticated mutations |
| Read | 120 / 60s | GET requests |
| Internal | 200 / 60s | Webhooks, cron, health |
| Authenticated write | 600 / 60s | Authed POST/PUT/PATCH/DELETE on /api/v1/* |
Some endpoints also enforce stricter per-route limits (for example lead or contact create).
Response headers
| Header | Meaning |
|---|---|
| X-RateLimit-Limit | Max requests in the window |
| X-RateLimit-Remaining | Remaining requests |
| X-RateLimit-Reset | When the window resets |
| Retry-After | Seconds to wait (on HTTP 429) |