Unverified50% confidenceReleaseExact time
v0.10.0 introduced login rate limiting: 10 wrong API Keys within 5 minutes trigger a 15-minute 429 lockout and return a Retry-After header, support proxy awareness via TRUSTED_PROXIES, and can be disabled with AUTH_THROTTLE=off.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/13/2026
First Seen
Valid until: 1/11/2027
Sources
Related Entities
Related Claims
UnverifiedAPI Keys are designed with no concept of expiration and remain valid long-term once generated; whereas tokens have an expiration time and require re-login to obtain after expiry.67% similarUnverifiedAfter an Idempotency-Key is passed in the request header to Stripe, the server will return the cached original response for requests with the same key within 24 hours and will not execute the charge operation again.66% similarUnverifiedAn access token obtained in exchange for a deleted key remains valid for its duration (typically tens of minutes to one hour), because OAuth tokens are stateless and Azure does not check in real time whether the key still exists during validation.64% similarUnverifiedFor scenarios using apiKeyHelper to return short-lived JWTs, expired cached tokens are refreshed before being sent, and 401/403 authentication errors are silently retried63% similarUnverifiedv1.10.0 fixes the session tool runner so that it stops after any end-of-turn idle (issue #969).62% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1017156API
curl https://kongchang.com/api/v1/knowledge/claims/1017156MCP
get_claim(id=1017156)