# aiqianshu rate limit reference

## Rate Limit Pattern (per IP)

| Endpoint | Method | Rate Limit | Notes |
|----------|--------|------------|-------|
| /api/user/register | POST | 2-3 per 10-15 min | The bottleneck |
| /api/user/login | POST | Unlimited* | Login freely |
| /api/token/ | POST | Unlimited* | Token creation |
| /api/token/batch/keys | POST | Unlimited* | Key extraction |
| /api/verification | POST | N/A | Send-code (NOT the register endpoint) |
| Browser send-code | POST | Unlimited | Different CSRF/session handling |
| Browser register | POST | Same as API | Shared rate limit |

*"Unlimited" means no observed rate limiting in practice during bulk operations.

## Code Expiry
- Verification codes expire in ~10 minutes
- Must register within 2-3 minutes for safety margin
- Expired codes return: `{"message":"Verification code is incorrect or has expired"}`

## 429 Response
- Empty body: `HTTP 429` with no JSON
- Applies to ALL POST endpoints on the rate-limited IP
- Recovery: ~5-15 minutes of inactivity
- Browser and API share the same rate limit counter

## Key Extraction Note
Keys created before ~aq0010 have `sk-` prefix. Later keys have alphanumeric format without prefix. Both formats work with `Authorization: Bearer <key>`.

## Proxy Handling
- HTTP proxies work reliably with requests library
- SOCKS5 proxies often fail on HTTPS endpoints
- Proxy test: POST to /api/user/login with dummy credentials, expect 200
- Dead proxies: timeout, connection refused, or non-200 status