Rate limits - trdrs Engine API

/api/market/* is limited per IP with a token bucket:

burst: 120 requests, spendable instantly;
refill: 30 requests per second, steady state.

The budget is sized so real client behavior never touches it. An initial chart load, a long scroll-back through history, and multi-panel quote polling all fit inside the burst. If you are being limited, you are almost certainly retrying in a tight loop or fanning one user action into many requests. Over the limit answers 429 with both a Retry-After header and a retryAfterSec field in the body. Wait that long, then continue. Do not retry tightly: the bucket refills at a fixed rate, so hammering it only delays your own recovery.

if (res.status === 429) {
  const wait = Number(res.headers.get('Retry-After') ?? 1)
  await new Promise((r) => setTimeout(r, wait * 1000))
  // then retry the same request
}

Trading and account routes are not bucket-limited. They are protected by idempotency and risk checks instead, which is the protection that surface actually needs.