To protect the platform from abuse and ensure fair usage, rate limiting is enforced by default on an IP-address basis. If a client exceeds the allowed number of requests within the specified time window, the API will return a 429 Too Many Requests status code.

Default Rate Limits

The following rate limits apply to various endpoints:

EndpointRate LimitTime Window
POST /login30 requests15 minutes
POST /signup30 requests60 minutes
POST /verify-email10 requests60 minutes
POST /forgot-password5 requests60 minutes
GET /client-side-api100 requests1 minute
POST /share100 requests60 minutes

If a request exceeds the defined rate limit, the server will respond with:

{
  "code": 429,
  "error": "Too many requests, Please try after a while!"
}

Disabling Rate Limiting

For self-hosters, rate limiting can be disabled if necessary. However, we strongly recommend keeping rate limiting enabled in production environments to prevent abuse.

To disable rate limiting, set the following environment variable:

RATE_LIMITING_DISABLED=1

After making this change, restart your server to apply the new setting.