From 2452b88a33ef106226ed03a55bb932555370d16a Mon Sep 17 00:00:00 2001 From: Rajkumar2002-Rk Date: Fri, 30 Oct 2026 01:18:13 -0500 Subject: [PATCH] docs(self-hosting): document the v2 per-IP limit that applies without billing --- .../docs/platform/self-hosting/environment-variables.mdx | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apps/docs/content/docs/platform/self-hosting/environment-variables.mdx b/apps/docs/content/docs/platform/self-hosting/environment-variables.mdx index 4a530eeeec7..e2f5eed097e 100644 --- a/apps/docs/content/docs/platform/self-hosting/environment-variables.mdx +++ b/apps/docs/content/docs/platform/self-hosting/environment-variables.mdx @@ -253,6 +253,8 @@ Most `/api` routes also pass through Next.js Proxy, which buffers only the first With `BILLING_ENABLED` disabled, hosted-plan execution rates/timeouts and table/storage quotas are not enforced unless you set their free-tier variables. Independent protocol, body-size, concurrency, and security rate limits still apply. Billing-enabled deployments enforce their plan limits. Keep `BILLING_ENABLED` and `NEXT_PUBLIC_BILLING_ENABLED` consistent so enforcement and the UI agree. +One of those security limits is easy to hit from scripts: the v2 API (`/api/v2/...`) allows each client IP a burst of 600 requests, then 300 per minute, checked before authentication. With Docker Compose, requests from the host share the bridge gateway IP and one budget. Behind a reverse proxy, set `AUTH_TRUSTED_PROXIES` so each client is counted by its own address. + Retention cleanup is separately opt-in through `DATA_RETENTION_ENABLED` or the enterprise suite. A configured retention policy still applies without billing; see [Data retention](/platform/enterprise/data-retention). | Variable | Opts in | Suggested value |