Skip to content
Waveform Licensing

Rate limits and reliability

Rate limits

Section titled “Rate limits”

The public /v1 endpoints are rate limited per client IP:

  • 60 requests per minute by default. A burst over the limit returns 429 with { "error": "rate-limited" } and a Retry-After header.
  • POST /v1/demo has a tighter limit still, to bound trial abuse.
  • Request bodies are limited to 32 KB.

A desktop app or plugin runs on the customer’s IP, so it will almost never reach the limit. A backend that validates on behalf of many users shares a single IP, so it shares a single budget. That is the case to plan for:

  • Cache a successful validate per session for 30 to 60 seconds. Always validate fresh on login.
  • Do not validate on every request. Validate on login, then at a keep-alive interval well inside the session TTL.
  • If a legitimate workload cannot live within the limit even with caching, talk to Waveform before you launch.

Timeouts and retries

Section titled “Timeouts and retries”

The hosted API may cold-start after idle. Use generous timeouts (about 20 seconds) for one-off calls such as activation, and retry transient failures (connection errors and 5xx), with backoff. The SDK does both: timeoutMs (default 20000) and maxAttempts (default 3, waiting 1 second then 2).

For a check on the request path of a busy service, do the opposite: one attempt and a short timeout (about 3 seconds), so a licensing outage costs milliseconds, not seconds. Decide on purpose whether to fail open or closed.

Never lock out a paying customer on a network error

Section titled “Never lock out a paying customer on a network error”
  • A definitive revoked, expired, or blocked means act now.
  • A network failure means keep the stored token and retry later. An offline product keeps working on its token until the lease, grace, and your own offline deadline run out.
  • Distinguish the two in your code. Treating “I could not reach the server” as “the license is invalid” is the fastest way to generate refund requests.

Status

Section titled “Status”

Live status is on the API status page. For your own monitoring, point it at GET https://api.waveformanager.com/readyz, which returns 200 only when the database is reachable too; /healthz just says the process is up.