express-rate-limit per surface. Each limiter keys on the client IP by default and emits the standard RateLimit-* headers so you can plan retries. Limits below are quoted as requests / window.
Endpoints without a dedicated limiter are not separately throttled at the application layer.
When you hit a limit
The response is429 Too Many Requests. Because limiters use standardHeaders, the standard headers are present:
Retry-After (seconds). On repeated 429s, back off exponentially with jitter — don’t retry in a tight loop.
