Rate limits
| Surface | Limit |
|---|---|
| Whole v1 API | 600 requests/min per key |
| Writes | 120/min per key (publishable keys: per key and IP, so one visitor cannot exhaust everyone's budget) |
| Sign-in | 10 attempts per 15 min per key + email |
| Sign-up | 5 per hour per key + end-user IP (send X-End-User-IP) |
| Sign-in link, password reset | 3 per 15 min per key + email |
| Resend verification email | 3 per 15 min per key + member session |
| Application submit | 10 per hour per IP |
| Checkout, paid apply and buyer refunds | 100 per 15 min per client IP, plus the per-key ceilings |
| Donations | 30 per hour per client IP, plus the per-key ceilings |
| Attendance lookup by email | 10 per min per IP |
| City autocomplete | 60 per min per visitor IP |
| Email broadcasts | 5 per community per 24 hours |
Every endpoint in the REST API reference shows its limit.
Limited responses
A limited call answers 429 with code: "RATE_LIMITED" and RateLimit
headers. Back off and retry later; for 503 responses, wait for the
Retry-After header.
Pass the visitor's IP
Per-person limits use the visitor's IP. Your server is the only caller
Cobuntu sees, so send X-End-User-IP with the visitor's address on calls made
for a visitor (the client's endUserIp option; see
The visitor's IP), otherwise every visitor
shares your server's bucket.
await cobuntu.auth.signUp(body, { endUserIp: request.headers.get("x-forwarded-for") ?? undefined });