> ## Documentation Index
> Fetch the complete documentation index at: https://secdocs.asikoexpress.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate Limiting

> Request limits enforced at the gateway

Rate limiting is enforced once, centrally, at api-gateway — individual backend services don't
apply their own limits.

| Bucket    | Limit                            | Applies to                    |
| --------- | -------------------------------- | ----------------------------- |
| `auth`    | 10 requests / minute per client  | Everything under `/v1/auth/*` |
| `default` | 100 requests / minute per client | Every other route             |

Limits are tracked per client (by IP) over a rolling 60-second window.

## Exceeding the limit

A throttled request receives:

```
HTTP/1.1 429 Too Many Requests
```

```json theme={null}
{
  "success": false,
  "statusCode": 429,
  "message": "ThrottlerException: Too Many Requests"
}
```

Back off and retry after a short delay. There's currently no `Retry-After` header — treat a `429`
as "wait at least a few seconds," particularly on the stricter `auth` bucket, which is intentionally
tight to slow down credential-stuffing and OTP brute-forcing.

## Timeouts

Independent of rate limiting, every request through the gateway has a **10 second** server-side
timeout. A request that doesn't complete in time gets a `408 Request Timeout` (`{"success":
false, "statusCode": 408, "message": "Request timed out"}`) rather than hanging indefinitely —
design clients to handle this the same way as any other transient failure.