1.5 KiB
1.5 KiB
aiqianshu rate limit reference
Rate Limit Pattern (per IP)
| Endpoint | Method | Rate Limit | Notes |
|---|---|---|---|
| /api/user/register | POST | 2-3 per 10-15 min | The bottleneck |
| /api/user/login | POST | Unlimited* | Login freely |
| /api/token/ | POST | Unlimited* | Token creation |
| /api/token/batch/keys | POST | Unlimited* | Key extraction |
| /api/verification | POST | N/A | Send-code (NOT the register endpoint) |
| Browser send-code | POST | Unlimited | Different CSRF/session handling |
| Browser register | POST | Same as API | Shared rate limit |
*"Unlimited" means no observed rate limiting in practice during bulk operations.
Code Expiry
- Verification codes expire in ~10 minutes
- Must register within 2-3 minutes for safety margin
- Expired codes return:
{"message":"Verification code is incorrect or has expired"}
429 Response
- Empty body:
HTTP 429with no JSON - Applies to ALL POST endpoints on the rate-limited IP
- Recovery: ~5-15 minutes of inactivity
- Browser and API share the same rate limit counter
Key Extraction Note
Keys created before ~aq0010 have sk- prefix. Later keys have alphanumeric format without prefix. Both formats work with Authorization: Bearer <key>.
Proxy Handling
- HTTP proxies work reliably with requests library
- SOCKS5 proxies often fail on HTTPS endpoints
- Proxy test: POST to /api/user/login with dummy credentials, expect 200
- Dead proxies: timeout, connection refused, or non-200 status