#Rate Limit Configuration

The rate-limit.conf file configures request rate limits and progressive failure backoff for the Issuer2 and Verifier2 services. This unified configuration file replaces the previous separate issuer2-rate-limit.conf and persistence-issuer2.conf files.

#Configuration Sections

The file contains three main sections:

persistence — Redis configuration for progressive failure backoff (shared between services)
issuer2_* — Rate limits for Issuer2 OID4VCI endpoints
verifier2_* — Rate limits for Verifier2 OID4VP endpoints

#Default Configuration

rate-limit.conf

# Persistence configuration for progressive failure backoff.
# Without Redis, only basic request-volume limits apply.
persistence {
  # Default: no Redis, failure backoff disabled
  # type = "memory"

  # Redis single-node example:
  # type = "redis"
  # nodes = [{ host = "redis", port = 6379 }]
  # user = "default"
  # password = "change-me"

  # Redis cluster example:
  # type = "redis-cluster"
  # nodes = [
  #   { host = "redis-node-1", port = 6379 },
  #   { host = "redis-node-2", port = 6379 },
  #   { host = "redis-node-3", port = 6379 }
  # ]
}

# Issuer2 OpenID4VCI rate limits
issuer2_token_endpoint {
  requestsPerMinute = 5
  failureWindowSeconds = 60
  failureThreshold = 5
  failureBlockSeconds = 300
}

issuer2_credential_endpoint {
  requestsPerMinute = 10
  failureWindowSeconds = 60
  failureThreshold = 5
  failureBlockSeconds = 300
}

# Verifier2 OpenID4VP rate limits
verifier2_request_endpoint {
  requestsPerMinute = 10
  failureWindowSeconds = 60
  failureThreshold = 5
  failureBlockSeconds = 300
}

verifier2_response_endpoint {
  requestsPerMinute = 5
  failureWindowSeconds = 60
  failureThreshold = 5
  failureBlockSeconds = 300
}

#Persistence Section

The persistence section configures Redis for progressive failure backoff. Without Redis, only basic Ktor request-volume limits apply.

Field	Type	Description
`type`	String	`"memory"` (default), `"redis"`, or `"redis-cluster"`
`nodes`	Array	List of Redis nodes with `host` and `port`
`user`	String	Optional Redis username
`password`	String	Optional Redis password

#Endpoint Rate Limit Fields

Each endpoint section (issuer2_token_endpoint, issuer2_credential_endpoint, verifier2_request_endpoint, verifier2_response_endpoint) supports the following fields:

Field	Type	Default	Description
`requestsPerMinute`	Integer	Varies	Maximum requests per minute per service/endpoint/IP
`failureWindowSeconds`	Integer	60	Time window for counting failures
`failureThreshold`	Integer	5	Failures required to create a block
`failureBlockSeconds`	Integer	300	Duration of the temporary block

#Default Rate Limits

Endpoint	Default `requestsPerMinute`
`issuer2_token_endpoint`	5
`issuer2_credential_endpoint`	10
`verifier2_request_endpoint`	10
`verifier2_response_endpoint`	5

Issuer2 Rate Limiting — Detailed configuration for issuer endpoints
Verifier2 Rate Limiting — Detailed configuration for verifier endpoints

Last updated on August 18, 2026

Features License