Rate limits

Lunar API rate-limit scopes, windows, and limits, plus slowdown behaviour and the fops bypass.

Rate limits

Rate limits are in-memory only, so they reset whenever the API restarts. They are applied per scope.

ScopeWindowLimitNotes
Global API2 minutes1000Slowdown after 1000 requests: 50 ms per extra request, capped at 3 s.
/auth/* group15 minutes50Slowdown after 10 requests: 500 ms per extra, capped at 5 s.
/auth/register1 hour3Slowdown after 1 request: 5 s per extra, capped at 60 s.
/auth/login (by IP)15 minutes8Successful logins do not consume the quota.
/auth/login (by username)15 minutes5Keyed by login:user:<username>. Successful logins do not consume the quota.

Response headers

Every rate-limited response sets:

  • X-RateLimit-Limit
  • X-RateLimit-Remaining
  • X-RateLimit-Reset
  • Retry-After (only when a request is rejected)

When a limit is exceeded

The API responds with 429:

{
  "status": 429,
  "message": "Too many requests from this IP, please try again later."
}