Rate limits

The verified rate limits on the console auth endpoints, what a 429 response looks like, and how fast to poll the agent metrics API.

Last updated

On this page

Only the console's authentication endpoints have hard rate limits today. Everything else — the rest of the console API and the agent metrics API — is unthrottled but still expects responsible use.

Console auth endpoints

EndpointLimitScope and window
POST /api/auth/login8 attempts per minutePer IP, fixed window
POST /api/auth/register10 attempts per hourPer IP, fixed window

Exceeding a limit returns 429 with a JSON error body:

429 response
{ "error": "too many attempts — try again later" }

Wait for the window to pass before retrying — immediate retries just fail again. No other console endpoint is separately rate limited today.

Agent metrics API polling

The agent's metrics API has no fixed request limit, but every poll costs the agent work. Use the dashboard's own cadence as the reference: it polls /metrics every 2 seconds while a server console page is open. Keep your own polling at intervals of 2 seconds or more, and use the console's proxied metrics endpoint when you want the data without holding the agent key yourself.

Stay under the limits

  • Cache responses instead of re-fetching on every loop iteration.
  • Stop polling when nobody is watching the data.
  • Log in once and reuse the pl_session cookie instead of scripting repeated logins.
  • Back off on 429 rather than retrying immediately.

Next steps