API
Rate Limiting
Rate limits on authentication endpoints and how to handle 429 responses.
Basira rate-limits authentication endpoints to prevent abuse. Data query endpoints (databases, queries, tables, etc.) are not rate-limited.
Limits
| Endpoint | Limit |
|---|---|
POST /api/v1/auth/signup | 5 per hour |
POST /api/v1/auth/login | 10 per hour |
POST /api/v1/auth/refresh | 30 per hour |
POST /api/v1/auth/forgot-password | 5 per hour |
POST /api/v1/auth/reset-password | 10 per hour |
POST /api/v1/auth/resend-verification | 5 per hour |
Additionally, forgot-password and resend-verification enforce a 60-second cooldown between requests for the same account.
Handling 429 Responses
When you exceed a rate limit, the API returns 429 Too Many Requests. Wait for the rate limit window to reset before retrying.
For programmatic access, use API key authentication instead of repeatedly calling login — API keys don't expire and data endpoints have no rate limits.