Rate Limits

Limits apply per API key, per user, per IP, and per model, plus daily request/token quotas per plan. Defaults: Free 10 req/min, 100 req/day, 50K tokens/day — all configurable in the plans table without code changes.

Exceeded minute limits return 429 rate_limit_exceeded; exhausted daily quotas return 429 insufficient_quota — both with Retry-After and without contacting any upstream provider.

The in-memory limiter is single-instance. Set REDIS_URL when running multiple instances — the swap is contained in src/limits.js.