Rate Limiting
How abusive request volume is limited.
Sensitive endpoints apply an in-memory rate limit keyed by client IP (derived from x-forwarded-for or x-real-ip). Each limiter is configured with a request count and a time window.
When the limit is exceeded the route returns 429 with a short message. The public pay and verify routes are rate-limited because they are reachable without authentication.