Rate Limiting

The Chainabit API enforces rate limits on all endpoints to ensure fair usage and protect against abuse. Limits are applied per authenticated user, per endpoint.

Global Default

All endpoints are subject to a default rate limit unless a specific limit is configured:

Parameter	Value
Requests	120
Window	60 seconds

This means each authenticated user can make up to 120 requests per minute to any given endpoint.

Auth Endpoint Limits

Authentication endpoints have tighter limits to protect against brute-force attacks:

Endpoint	Limit	Window
POST /auth/register	10 requests	5 minutes
POST /auth/login	8 requests	60 seconds
POST /auth/resend-confirmation	5 requests	5 minutes
POST /auth/confirm-email	5 requests	5 minutes
POST /auth/forgot-password	3 requests	5 minutes
POST /auth/reset-password	5 requests	5 minutes
POST /auth/exchange-recovery-code	15 requests	5 minutes
GET /auth/check-username	20 requests	60 seconds
POST /auth/claim-username	5 requests	60 seconds
POST /auth/change-email	10 requests	60 seconds
POST /auth/change-password	10 requests	60 seconds

Other Specific Limits

Endpoint	Limit	Window
POST /billing/checkout	5 requests	60 seconds
POST /mcp	60 requests	60 seconds

Handling Rate Limit Errors

When you exceed the rate limit, the API responds with HTTP 429 Too Many Requests:

{
  "error": {
    "code": "RATE_LIMIT_EXCEEDED",
    "message": "Rate limit exceeded"
  },
  "meta": {
    "requestId": "req_abc123",
    "durationMs": 1
  }
}

Recommended Client Behavior

1. Implement exponential backoff. When you receive a 429 response, wait before retrying. Double the wait time on each consecutive 429.
2. Track your request rate. If you are approaching the limit, spread requests over time rather than sending them in bursts.
3. Cache responses. For read-heavy workloads, cache responses client-side to reduce the number of API calls.

Example Backoff Strategy

Attempt 1: wait 1 second
Attempt 2: wait 2 seconds
Attempt 3: wait 4 seconds
Attempt 4: wait 8 seconds
(cap at 30 seconds)