Public API
Rate limits
Limits are per API key (and per client IP for auth attempts).
Current limits
Cache the menu on your side (≈60s) instead of fetching on every page view.
Limits are currently process-local (effective ceiling ≈ limit × serverless instances). Durable Redis/Upstash limiting lands before card payments.
| Endpoint group | Limit |
|---|---|
| Reads (/storefront, /menu, /locations) | 120 / min per key |
| POST /orders | 10 / min per key |
| Auth attempts (any key, including invalid) | 60 / min per client IP |