Rate limiting (security)

Defending against abuse with rate limits. Per-user, per-IP, per-endpoint patterns.

vly’s API has built-in rate limits per key. For your app’s user-facing endpoints (login, signup, public forms), implement application-level rate limits to defend against abuse.

The pattern lives in Architecture → Rate limiting. Quick summary:

await ctx.runMutation(api.rateLimit.checkAndIncrement, {
  key:      `login:${email}`,
  limit:    10,
  windowMs: 60 * 1000,  // 10 per minute
});

Where to apply

Endpoint	Limit
Login	10 per IP per minute, 20 per user per hour
Signup	5 per IP per hour
Password reset	3 per email per hour
Public forms	10 per IP per minute
Comments / posts	60 per user per minute
API endpoints exposed to your users	Per-key (custom)

Tips

Combine with CAPTCHA. Rate limits stop bulk abuse; CAPTCHA stops sophisticated attackers who use slow drips.

Log rate-limit hits. Repeated hits from the same IP may indicate a coordinated attack.

Related

Architecture: rate limiting

Implementation.

Auth best practices

Where rate limits matter most.

API rate limits

vly’s built-in API limits.