Rate Limiting - Join Markt Docs

Public and checkout routes use per-client sliding windows via rateLimit(identifier, { maxRequests, windowMs }) in lib/rateLimit.ts. Identity comes from getClientIdentifier(req) (IP / forwarded headers).

Integrator budgets

Endpoint	Max	Window
`POST /api/embed/checkout`	30	60s
`POST /api/checkout/start`	15	60s
`POST /api/checkout/client-gate`	30	60s
`POST /api/orders/create`	10	60s
`POST /api/coupons/validate`	20	route window
`POST /api/track`	120	60s
`GET /api/feedback`	60	60s
`POST /api/feedback/create`	5	60s
Payment create routes	typically 60–180	per route
Auth login	20	route window
Auth register / forgot	3	route window

Public catalog GETs (…/storefront, …/products, GET /api/store/{subdomain}) currently have no route-level rate limit — still cache-friendly; do not hammer them from scrapers.

429 shape

Embed example:

{
  "error": "Too many requests. Please try again later."
}

Some routes also emit Retry-After / X-RateLimit-* headers via rate-limit-guard helpers.

Guidance

Debounce buy buttons.
Call Markt.init() once per page.
Cache catalog responses client-side for short TTL.
Payment verify polling should back off — prefer webhooks for settlement.

⌘I