MBKTech logo BKAuthe
MBKAuthe / Docs / API & Developer Reference

Operational & Rate Limits

HTTP status codes, security best practices, and rate-limiting thresholds.

Topic Area API & Developer Reference
Package Version v5.7.1
Reading Time ~2 min read
License / Source MIT • Open Source

# Operational Reference

Back to API index | Back to docs index | Back to project README

Error Codes #

HTTP Status Codes #

CodeMeaningUsage
200OKSuccessful request
400Bad RequestInvalid input data
401UnauthorizedAuthentication required or failed
403ForbiddenInsufficient permissions
404Not FoundResource not found
429Too Many RequestsRate limit exceeded
500Internal Server ErrorServer-side error

Security Best Practices #

  1. Always use HTTPS in production - Set IS_DEPLOYED=true and ensure your server uses SSL/TLS
  2. Keep SESSION_SECRET_KEY secure - Use a strong, randomly generated key
  3. Enable 2FA for sensitive applications - Set MBKAUTH_TWO_FA_ENABLE=true
  4. Validate all user input - Never trust client-side data
  5. Use rate limiting - Already implemented for authentication endpoints
  6. Keep dependencies updated - Regularly update npm packages
  7. Monitor for security vulnerabilities - Use npm audit
  8. Use prepared statements - Prevent SQL injection (already implemented)
  9. Implement proper logging - Track authentication events
  10. Regular security audits - Review code and configurations

Rate Limits #

Auth Endpoints #

EndpointLimitWindow
/mbkauthe/api/login8 requests1 minute
/mbkauthe/api/logout10 requests1 minute
/mbkauthe/api/verify-2fa5 requests1 minute
/mbkauthe/api/github/login10 requests5 minutes
/mbkauthe/api/github/login/callback10 requests5 minutes
/mbkauthe/login8 requests1 minute
/mbkauthe/info8 requests1 minute
/mbkauthe/test8 requests1 minute

CLI Device Flow #

EndpointLimitWindow
POST /api/cli/device20 requests1 minute
POST /api/cli/device/approve30 requests1 minute
POST /api/cli/device/token60 requests1 minute

Admin Endpoints #

EndpointLimitWindow
Admin operations (terminate sessions, etc.)3 requests5 minutes

Rate limits are applied per IP address. Logged-in users are exempt from some rate limits (e.g., login page rate limit). The /mbkauthe/cli/device/:userCode page render is session-authenticated and not rate-limited.

Previous Topic Middleware Reference Next Topic Error Codes Directory
Suggest an edit on GitHub Back to top