> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackra.figentra.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 0038 — Rate limits: app token buckets and Cloudflare WAF

> Superseded by 0217 · 2026-10-20

> [!NOTE]
>
> Superseded by [0217](/adr/0217-api-surfaces-mcp-first-plus-rest-sdks-and-rate-limits): MCP first
> plus REST, SDKs and rate limits. The Cloudflare WAF decision carries forward.

## Context

Abuse needs stopping at two points: at the edge before it costs compute, and in the app where the caller's identity and plan are known.

## Decision

1. **Cloudflare WAF and rate rules guard the edge** against volumetric and unauthenticated abuse.
2. **The application enforces token buckets** per tenant, per token and per endpoint class, keyed on authenticated identity.
3. A limited call returns `429` with `Retry-After`.
4. Bucket sizes and plan-based limits: TODO; they tie to tenant entitlements, which are decided separately.

## Consequences

* Two layers to configure; edge rules are outside the Encore app.

## Enforcement

Planned — a shared rate-limit helper with a test; Cloudflare rules kept as code, with a drift check.

## Supersedes and sources

Supersedes: none. Sources: owner decisions in chat, 2026-10-19.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.