# Rate limits

> The verified rate limits on the console auth endpoints, what a 429 response looks like, and how fast to poll the agent metrics API.
>
> Canonical: https://xdp.network/docs/api-reference/rate-limits · Updated 2026-08-09

Only the console's authentication endpoints have hard rate limits today. Everything
else — the rest of the console API and the agent metrics API — is unthrottled but
still expects responsible use.

## Console auth endpoints

| Endpoint | Limit | Scope and window |
| --- | --- | --- |
| `POST /api/auth/login` | 8 attempts per minute | Per IP, fixed window |
| `POST /api/auth/register` | 10 attempts per hour | Per IP, fixed window |

Exceeding a limit returns `429` with a JSON error body:

```json title="429 response"
{ "error": "too many attempts — try again later" }
```

Wait for the window to pass before retrying — immediate retries just fail again. No
other console endpoint is separately rate limited today.

## Agent metrics API polling

The agent's metrics API has no fixed request limit, but every poll costs the agent
work. Use the dashboard's own cadence as the reference: it polls `/metrics` every 2
seconds while a server console page is open. Keep your own polling at intervals of 2
seconds or more, and use the console's
[proxied metrics endpoint](/docs/api-reference/endpoints) when you want the data
without holding the agent key yourself.

## Stay under the limits

- Cache responses instead of re-fetching on every loop iteration.
- Stop polling when nobody is watching the data.
- Log in once and reuse the `pl_session` cookie instead of scripting repeated logins.
- Back off on `429` rather than retrying immediately.

## Next steps

- [Authentication](/docs/api-reference/authentication)
- [Errors](/docs/api-reference/errors)
- [Enabling metrics](/docs/openshield-xdp/enabling-metrics)