> ## Documentation Index
> Fetch the complete documentation index at: https://vlyai-1c28d863.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate limiting (security)

> Defending against abuse with rate limits. Per-user, per-IP, per-endpoint patterns.

vly's API has built-in [rate limits per key](/api-reference/rate-limits). For your app's user-facing endpoints (login, signup, public forms), implement application-level rate limits to defend against abuse.

The pattern lives in [Architecture → Rate limiting](/architecture/rate-limiting). Quick summary:

```typescript theme={null}
await ctx.runMutation(api.rateLimit.checkAndIncrement, {
  key:      `login:${email}`,
  limit:    10,
  windowMs: 60 * 1000,  // 10 per minute
});
```

## Where to apply

| Endpoint | Limit |
| - | - |
| Login | 10 per IP per minute, 20 per user per hour |
| Signup | 5 per IP per hour |
| Password reset | 3 per email per hour |
| Public forms | 10 per IP per minute |
| Comments / posts | 60 per user per minute |
| API endpoints exposed to your users | Per-key (custom) |

## Tips

<Tip>
  **Combine with CAPTCHA.** Rate limits stop bulk abuse; CAPTCHA stops sophisticated attackers who use slow drips.
</Tip>

<Tip>
  **Log rate-limit hits.** Repeated hits from the same IP may indicate a coordinated attack.
</Tip>

## Related

<CardGroup cols={3}>
  <Card title="Architecture: rate limiting" icon="gauge" href="/architecture/rate-limiting">
    Implementation.
  </Card>

  <Card title="Auth best practices" icon="lock" href="/security/auth-best-practices">
    Where rate limits matter most.
  </Card>

  <Card title="API rate limits" icon="key" href="/api-reference/rate-limits">
    vly's built-in API limits.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.