From d9b653ff44c3f8362ff045fabfc815938d9b3a07 Mon Sep 17 00:00:00 2001
From: Henry <henry_ball@hotmail.co.uk>
Date: Fri, 17 Oct 2025 22:20:39 +0100
Subject: [PATCH] feat: extend apiKey rate limit

---
 packages/auth/src/auth.ts | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/packages/auth/src/auth.ts b/packages/auth/src/auth.ts
index f40e4303..0f056d6f 100644
--- a/packages/auth/src/auth.ts
+++ b/packages/auth/src/auth.ts
@@ -240,7 +240,14 @@ export const initAuth = (db: dbClient) => {
           ]
         : []),
       // @todo: hasing is disabled due to a bug in the api key plugin
-      apiKey({ disableKeyHashing: true }),
+      apiKey({
+        disableKeyHashing: true,
+        rateLimit: {
+          enabled: true,
+          timeWindow: 1000 * 60, // 1 minute
+          maxRequests: 100, // 100 requests per minute
+        },
+      }),
       magicLink({
         expiresIn: 60 * 60 * 24 * 7, // 7 days
         sendMagicLink: async ({ email, url }) => {