fix: disable Better Auth API key rate limits

[R44VC0RP]

Summary

• Disables Better Auth's per-API-key rate limiting in favor of Upstash Redis rate limiting

Problem

Users reported intermittent 401 "Authentication required" errors when making API calls (e.g., deleting email addresses). The actual cause was hitting Better Auth's rate limit (4 req/sec per key), but the error message was misleading.

Root cause: Better Auth's verifyApiKey() returns { valid: false } when rate-limited, and our E2 middleware treated all invalid responses as auth failures → 401.

Solution

Disable Better Auth rate limits entirely. Rate limiting is already handled by Upstash Redis in app/api/e2/lib/auth.ts which:

Feature	Better Auth (disabled)	Upstash (active)
Limit	4 req/sec per key	10 req/sec per user
Storage	Postgres (DB write per request)	Redis
Error response	401 (wrong)	429 with proper headers
Headers	None	X-RateLimit-*, Retry-After

Changes

• lib/auth/auth.ts: Set rateLimit.enabled: false in apiKey plugin config

Testing

• API calls that previously hit the 4/sec limit will now succeed (up to 10/sec)
• Rate limit errors will correctly return 429 with helpful headers

---

Note

Medium Risk
Touches API key authentication behavior; disabling built-in throttling relies on external middleware being correctly configured, which could affect protection against abuse if misconfigured.

Overview
Disables Better Auth’s per-API-key rate limiting by setting apiKey().rateLimit.enabled to false in lib/auth/auth.ts.

Adds inline comments clarifying that rate limiting is handled elsewhere (Upstash in E2 middleware) to avoid duplicate limits and to return proper 429 responses instead of misleading 401s.

^{Written by Cursor Bugbot for commit b9de77e. This will update automatically on new commits. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
inbound.new	Error		Feb 2, 2026 5:29pm