Rate limiting

Sigma applies multiple rate-limit layers. Limits are per route and identifier; there is no universal quota or blanket limit across every custom API.

Better Auth endpoints

All /api/auth/* calls share the custom route wrapper's 100 requests/minute per client IP budget. Better Auth also applies its own rules. In production, the explicit rules are:

The configured Better Auth general limit is 150/minute, but the shared 100/minute wrapper or a built-in special rule may reject a request first. Clients sharing a public IP also share these budgets. Development/test values differ.

Custom routes

Auth-flow challenges and device-request metadata use a 50/minute bucket. Profile mutations such as delegation issuance and domain verification use 5/minute buckets with route-specific user/session identifiers. General public handle/messagebox requests use 100/minute buckets. Admin routes use 25/minute. Only routes that call a limiter participate; a named bucket existing in configuration does not mean every matching feature uses it.

Backup sync has a separate process-local 20/minute IP limiter. Do not treat it as a global distributed quota. Upstash-backed helpers generally fail open on storage failure; some handle/messagebox routes turn unavailable enforcement into a 503 instead.

Handle throttling

For a 429, honor Retry-After before making another request. The custom limiter emits RateLimit, RateLimit-Policy, and X-RateLimit-* headers; Better Auth may emit a different subset. Do not depend on all headers being present or parse human-readable error messages.

Use bounded backoff with jitter for retryable reads. Do not automatically retry a mutation unless its idempotency contract permits it. Authorization codes are single-use: after an uncertain exchange, reconcile your local session or restart the flow. Device polling must respect both the returned interval and slow_down responses.

These are operational controls, not the proposed commercial attestation quotas on the pricing page.