36 lines
1.5 KiB
Markdown
36 lines
1.5 KiB
Markdown
# aiqianshu rate limit reference
|
|
|
|
## Rate Limit Pattern (per IP)
|
|
|
|
| Endpoint | Method | Rate Limit | Notes |
|
|
|----------|--------|------------|-------|
|
|
| /api/user/register | POST | 2-3 per 10-15 min | The bottleneck |
|
|
| /api/user/login | POST | Unlimited* | Login freely |
|
|
| /api/token/ | POST | Unlimited* | Token creation |
|
|
| /api/token/batch/keys | POST | Unlimited* | Key extraction |
|
|
| /api/verification | POST | N/A | Send-code (NOT the register endpoint) |
|
|
| Browser send-code | POST | Unlimited | Different CSRF/session handling |
|
|
| Browser register | POST | Same as API | Shared rate limit |
|
|
|
|
*"Unlimited" means no observed rate limiting in practice during bulk operations.
|
|
|
|
## Code Expiry
|
|
- Verification codes expire in ~10 minutes
|
|
- Must register within 2-3 minutes for safety margin
|
|
- Expired codes return: `{"message":"Verification code is incorrect or has expired"}`
|
|
|
|
## 429 Response
|
|
- Empty body: `HTTP 429` with no JSON
|
|
- Applies to ALL POST endpoints on the rate-limited IP
|
|
- Recovery: ~5-15 minutes of inactivity
|
|
- Browser and API share the same rate limit counter
|
|
|
|
## Key Extraction Note
|
|
Keys created before ~aq0010 have `sk-` prefix. Later keys have alphanumeric format without prefix. Both formats work with `Authorization: Bearer <key>`.
|
|
|
|
## Proxy Handling
|
|
- HTTP proxies work reliably with requests library
|
|
- SOCKS5 proxies often fail on HTTPS endpoints
|
|
- Proxy test: POST to /api/user/login with dummy credentials, expect 200
|
|
- Dead proxies: timeout, connection refused, or non-200 status
|