Rate Limits and Constants

All quotas and constants applied by the Vault Worker and its Durable Object instances.

Constant	Value	Applies to
`MAX_REGISTRATIONS_PER_IP`	`3`	`POST /api/sessions`
`MAX_VERIFY_ATTEMPTS`	`5`	`POST /api/verify/check` per code (email)
`EMAIL_CODE_EXPIRY_SECONDS`	`90`	Email OTP TTL
`RATE_LIMIT_CODES_PER_IDENTIFIER`	`5`	`POST /api/verify/send` per identifier per hour (email)
`MAX_VERIFY_SENDS_PER_IP`	`3`	`POST /api/verify/send` per IP per day
`ATTESTATION_TTL_SECONDS`	`300`	Verification attestation TTL

IP-based limits use the CF-Connecting-IP header, which Cloudflare sets to the originating client IP. Limits reset on rolling windows tied to the limit type (per hour, per day, etc.).

Payment Handler