Stratify
Internal ops

B2b Rate Limits

docs/internal/b2b-rate-limits.md

Source updated 03. Aug. 2026

B2B /api/v1 rate limits (v2.1)

Implemented in apps/web/lib/api/rate-limit.ts. Backed by the api_request_log table (Postgres). Postgres counter is fine at pre-license scale (≤ 200 req/s). At higher tiers move to Redis/Upstash keyed by partner_id.

SettingValue
Window60 seconds rolling
Default limit60 req/min/partner
Audit-log endpoint30 req/min/partner (lower — heavier query)
ScopeGlobal (Postgres) — shared across Hetzner Node runtime instances
Storageapi_request_log (purged daily via cron, planned)

On exceed → HTTP 429, JSON body {"error": "rate_limited"}, retry-after header (seconds).

Future hardening

  • Sliding-window via tsvector or a dedicated bucket table once a partner

brings >10 req/s sustained

  • Redis/Upstash migration: cheaper at scale than Postgres scans
  • Per-route override: subscription writes lower than reads
  • Per-key (not just per-partner) accounting once partners issue dev/CI/prod keys