# Rate Limiting & Anti-Spam

Understand the security protocols that protect your project.

---

To protect your project balance and avoid spam attacks, **ReOTP** implements automatic and robust rate limiting on verification requests:

### Rate Limits
- The system automatically rejects requests if a **Phone Number** or **IP Address** exceeds **5 requests per 15 minutes**.
- When this limit is exceeded, the API responds with a <code>429 Too Many Requests</code> status code.

### API Key Security
- Keep your <code>API Key</code> safe.
- In the dashboard, configure the Allowed Domains (Whitelisting) to ensure requests are only accepted from your verified sites and applications.