Rate limit envelope. Budgets are per API key (120 requests per minute by default) and per IP (240 requests per minute by default). Successful responses carry X-RateLimit-Limit and X-RateLimit-Remaining, throttled ones add X-RateLimit-Reset and Retry-After. Repeated authentication failures from one IP lock it out for 15 minutes.