Skip to main content
Aquila limits by risk, not by volume. Reads draw no budget, so you can move between pages and agents without seeing 429. Limits apply only where abuse has a real cost.

​
Tiers

Each tier is its own bucket. A heavy call never eats the budget of an unrelated page. Rules:
  • The budget is per user, keyed by your session or API key. Unauthenticated callers share a per-IP bucket.
  • Windows slide. Counters live in Postgres.
  • The limiter is best-effort. During a cache outage requests pass through rather than fail.

​
Auth routes

Better Auth runs its own limiter on /api/auth/* before the platform tiers:

​
Headers

Limited responses carry these headers:
  • X-RateLimit-Limit — the tier budget.
  • X-RateLimit-Remaining — the calls still available in the window.
  • X-RateLimit-Reset — when the window resets.
A 429 response also carries Retry-After. Wait that long, then send the request again. Reads never return 429.