Rate limits and CORS#
Rate limiting#
The limit is not global. It applies only to selected sensitive endpoints.
| Endpoint | Key | Limit |
|---|---|---|
auth/login |
username and IP, failed attempts only | 5 per 5 minutes |
auth/refresh |
IP, every attempt | 30 per 5 minutes |
user/show-phone |
IP | 20 per hour |
user/send-new-password |
IP / user | 10 per hour / 3 per hour |
Exceeding it returns 429 with a Retry-After header and a body carrying code
404.
Ordinary reads and writes are not limited
That does not mean anything goes — large includes and frequent queries load
the server just the same.
Failed sign-ins count, successful ones do not
A correctly authenticated client does not hit the limit.
CORS#
This concerns browser calls only. A server-side request is not restricted by CORS.
| Setting | Value |
|---|---|
| Allowed origins | a list; by default only local development addresses |
| Methods | GET, POST, PUT, PATCH, DELETE, OPTIONS |
| Headers | Authorization, X-API-Key, Content-Type, X-Requested-With, Accept |
| Exposed headers | none |
| Credentials | allowed |
| Preflight lifetime | 1 hour |
Your domain must be on the list
If it is not, the server responds and the browser discards the response. It looks like an API outage. Ask the operator to add your domain.
You cannot read Retry-After from a browser
The header is not exposed. When rate limited in a browser you cannot tell how long to wait — apply your own backoff.
Preflight#
An OPTIONS request is handled before authentication and returns 204. For a
disallowed origin it returns 204 without the allow header.
Client recommendations#
On receiving a 429, back off progressively
Retrying immediately only extends the limit.
Refresh the token ahead of time, not on a 401
An access token lasts 15 minutes. Refreshing a minute early saves pointless failed requests.
Do not use includes=*
The fastest way to slow your own integration down.