Rate limits

Every authenticated response carries X-RateLimit-Limit (requests per minute), X-RateLimit-Remaining and X-RateLimit-Reset (unix seconds). When you exceed a limit you get 429 rate_limited with a Retry-After header (seconds). Limits are per API key or session. Signup is limited per IP address (a small burst, then about one per minute). Sign-in and password-reset requests are limited per email address and IP address together, with a looser per-email ceiling, so someone guessing from elsewhere cannot lock you out.