7. Rate limits and size limits
7.1 Rate limits
| Scope | Limit | Response |
|---|---|---|
Better Auth sign-in (/sign-in/email) | 10 per 60 s | Better Auth 429 |
Better Auth sign-up (/sign-up/email) | 5 per 60 s | Better Auth 429 |
Better Auth password reset (/request-password-reset) | 3 per 300 s | Better Auth 429 |
Better Auth two-factor (/two-factor/*) | 10 per 60 s | Better Auth 429 |
| Better Auth default | 60 per 60 s | Better Auth 429 |
| Better Auth 2FA account lockout | 5 failed attempts, locked 15 minutes | Better Auth error |
| Contact form | 5 inquiries in 15 minutes | 429 RATE_LIMITED |
| Report exports, concurrency | 3 active jobs per tenant by default (max 10) | 429 LIMIT_REACHED |
| Report exports, daily | 20 jobs per tenant per UTC day by default (max 100) | 429 LIMIT_REACHED |
| Report exports, storage and operations ceiling | Platform storage safety ceiling | 503 FEATURE_UNAVAILABLE |
Additional network-level protections apply and are not published.
7.2 Size limits
| Route | Limit | Code |
|---|---|---|
| Generic resources, finance transactions, finance applications, financing cases, reconciliation, reporting jobs, contact | 256 KiB JSON body (declared length and actual bytes) | PAYLOAD_TOO_LARGE (finance wrapper) or VALIDATION_ERROR (generic helper) |
| Marketplace decision | 8 KiB (declared Content-Length) | 413 PAYLOAD_TOO_LARGE |
| Push subscription | 8 KiB (declared Content-Length) | 413 PAYLOAD_TOO_LARGE |
| Provider webhook | 1 MiB (declared and actual bytes) | 413 PAYLOAD_TOO_LARGE |
Report export expectedMaxBytes | 50,000,000 bytes per export | 400 VALIDATION_ERROR |
Generic and finance routes also reject JSON nested deeper than 12 levels, arrays longer than 1,000 items, and strings longer than 10,000 characters (validateJsonValue).