API rate limiting

The gateway applies a global rate limit to authenticated /v1 routes (default 600 requests per minute per IP). Auth routes have a separate, stricter limit.

Configure

.env

ISOWARD_API_RATE_LIMIT_MAX=600

Webhook and non-API paths are excluded from this limit.