> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nullpass.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate Limiting

> Arcjet protection and rate limiting configuration

## Overview

Null Pass uses [Arcjet](https://arcjet.com) for comprehensive request protection including rate limiting, bot detection, and shield protection.

## Protection Features

<AccordionGroup>
  <Accordion title="Rate Limiting" icon="gauge">
    Token bucket algorithm prevents abuse by limiting requests per time window.

    **Default Configuration:**

    * Most endpoints: Standard rate limit
    * Registration/Login: 2 requests per bucket
    * Password change: 2 requests per bucket
  </Accordion>

  <Accordion title="Bot Detection" icon="robot">
    Arcjet analyzes request patterns to detect and block automated bots and scrapers.
  </Accordion>

  <Accordion title="Shield Protection" icon="shield">
    Additional layer of protection against malicious requests and attacks.
  </Accordion>

  <Accordion title="Email Validation" icon="envelope">
    Email validation for registration endpoint to prevent invalid or disposable emails.
  </Accordion>

  <Accordion title="Sensitive Info Detection" icon="eye-slash">
    Detects and blocks requests containing sensitive information like API keys or passwords.
  </Accordion>
</AccordionGroup>

## Implementation

### Code Reference

```typescript theme={null}
// lib/arcjet.ts
import { protectRoute } from '@/lib/arcjet'

// Usage in routes
const blocked = await protectRoute(request, { requested: 2 })
if (blocked) return blocked
```

### Protection Levels

Different endpoints use different protection levels:

* **Standard**: Default Arcjet protection
* **High**: Registration, login, password change (2 requests per bucket)

## Error Responses

When blocked by Arcjet, endpoints return:

```json theme={null}
{
  "error": "Rate limit exceeded"
}
```

**Status Code:** `403 Forbidden`

## Configuration

Arcjet is configured via environment variables:

<ResponseField name="ARCJET_KEY" type="string" required>
  Arcjet API key for authentication
</ResponseField>

## Best Practices

<Warning>
  **For Internal Use:**

  * Monitor rate limit errors in logs
  * Implement exponential backoff for retries
  * Cache responses where appropriate
  * Use appropriate request patterns to avoid triggering limits
</Warning>

<Tip>
  Rate limits are per IP address and endpoint. Different endpoints have different limits.
</Tip>

## Monitoring

Rate limit violations are logged:

* Check application logs for Arcjet blocking events
* Monitor 403 responses for rate limit patterns
* Adjust protection levels if needed for legitimate use cases

## Bypassing (Internal Only)

For internal testing or admin operations:

* Use admin endpoints if available
* Contact system administrator for rate limit adjustments
* Use different IP addresses for testing (not recommended for production)