Rate limits

Only the pre-authentication endpoints are throttled today.

What is limited

10 requests per minute, per IP:

• POST /auth/register
• POST /auth/login
• POST /auth/two-factor-challenge
• POST /auth/passkeys/login/options and POST /auth/passkeys/login
• POST /auth/passkeys/options and POST /auth/passkeys
• Everything under /auth/two-factor/ except GET /auth/two-factor

Exceeding one returns 429 with a Retry-After header.

What is not limited

Everything else, including every brand-scoped endpoint and the entire MCP server, has no rate limit.

Do not read that as an invitation

The absence of a limit is a current implementation fact, not a guarantee. Limits will be added when they are needed, and a client written to hammer the API will be the one that breaks. Be a reasonable client:

• Back off on 429 and on 5xx.
• Do not poll faster than the underlying data changes. Metrics sync nightly, so polling metrics every minute reads the same numbers roughly 1,400 times a day for nothing.
• Batch your writes. POST /ideas/import takes 25 ideas per call, so send 25, not one at a time.

Caps that are not rate limits

These are hard ceilings on a single call rather than a rate.

Limit	Value
Ideas per POST /ideas/import call	25
Ref window returned by GET /ideas/mining-context	90 days
Brand header	X-Postlyra-Brand

list_ideas on MCP returns at most 50 ideas, and it has no pagination cursor. Filter by status or format to narrow instead.

Media uploads are capped at 10 MB per file, separately from your plan's total storage allowance.