> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vouchmark.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate limits

> Per-IP request limits and how to handle 429s.

Vouchmark applies `express-rate-limit` per surface. Each limiter keys on the **client IP** by default and emits the standard `RateLimit-*` headers so you can plan retries. Limits below are quoted as `requests / window`.

| Surface                                                                                                       | Limit | Window   |
| ------------------------------------------------------------------------------------------------------------- | ----- | -------- |
| Auth (`/login`, `/signup`, `/google-*`, `/forgot-password`, `/reset-password`, `/verify-email`, login OTP, …) | 50    | 15 min   |
| Public forms (`/subscribe`, `/book-demo`)                                                                     | 20    | 15 min   |
| Verification uploads (`/verifyTin`, `/verifyBill`, `/verifyJtbTin`, `/verifyCac*`)                            | 10    | 1 hour   |
| Physical address verification (`POST /physicalAddress`)                                                       | 5     | 24 hours |
| Monitoring reads (`GET /monitoring/*`)                                                                        | 120   | 1 min    |
| Monitoring writes (watchlist add/remove, mark alert read)                                                     | 30    | 1 min    |
| Wallet reads (`GET /wallet`, `/wallet/transactions`, `/wallet/pricing-rates`)                                 | 60    | 1 min    |
| Wallet writes (`/wallet/topup`, `/wallet/auto-top-up`, `/wallet/threshold`)                                   | 10    | 1 min    |
| API key rotation (`POST /developers/api-keys/rotate`)                                                         | 20    | 1 hour   |
| Webhook changes (`POST`/`DELETE /developers/webhooks`)                                                        | 100   | 1 hour   |

Endpoints without a dedicated limiter are not separately throttled at the application layer.

## When you hit a limit

The response is `429 Too Many Requests`. Because limiters use `standardHeaders`, the standard headers are present:

```http theme={null}
RateLimit-Limit: 120
RateLimit-Remaining: 0
RateLimit-Reset: 23
Retry-After: 23
```

The body is the limiter's configured message, for example:

```json theme={null}
{
  "success": false,
  "message": "Too many attempts from this IP, please try again after 15 minutes"
}
```

Respect `Retry-After` (seconds). On repeated 429s, back off exponentially with jitter — don't retry in a tight loop.

## Increasing limits

These ceilings cover normal product use. If you're building a high-throughput integration, contact [support@vouchmark.com](mailto:support@vouchmark.com) with your use case.