How Rate Limiting Works
Boottify applies rate limiting across all 23 authentication API routes to protect your account from brute-force attacks and abuse. The system uses a 5-tier approach based on endpoint sensitivity.
Rate Limiting Tiers
| Tier | Limit | Window | Applies To |
|---|---|---|---|
| Critical | 3 requests | 15 minutes | Password reset, 2FA verification |
| Strict | 5 requests | 15 minutes | Sign-in, sign-up |
| Auth | 10 requests | 15 minutes | OAuth callbacks, session validation |
| Standard | 30 requests | 1 minute | Profile updates, settings changes |
| Relaxed | 60 requests | 1 minute | Read-only endpoints, status checks |
What Happens When You Hit a Limit
When a rate limit is exceeded, the API returns a 429 Too Many Requests response with a Retry-After header indicating how many seconds to wait before retrying.
Best Practices
- Implement exponential backoff in your API integrations
- Cache authentication tokens instead of re-authenticating on every request
- Use webhook callbacks instead of polling for status updates
- Contact support if you need higher limits for legitimate use cases