Upstash Redis Rate Limiting#

To guarantee high availability and protect against Denial of Service (DoS) attacks, every single API endpoint is shielded by a sliding-window rate limiter powered by Upstash Redis.

The system tracks incoming requests per IP address in real-time. For standard write operations (like saving a setting), the limit is typically 20 requests per minute. For economy-critical operations (like opening a crate or transferring currency), the limit is stricter at 10 requests per minute.

If an IP exceeds these limits within the defined time window, subsequent requests are automatically blocked by Redis at the edge, returning a standard 429 Too Many Requests response until the sliding window resets.