API server config
Path: /admin-settings → API Server Config tab
Configure how the API server (TelAPI) instance set scales under load, and how inbound requests are throttled.
General
| Field | Required | Description |
|---|---|---|
| Enabled | Yes | Master toggle for the config. |
Auto-scaling
Same model as Server groups applied to API server instances.
| Field | Required | Default | Description |
|---|---|---|---|
| Scaling Enabled | Yes | false | Master toggle. |
| Min Instances | Yes | 1 | Never scales below. |
| Max Instances | Yes | 10 | Never scales above. |
| Scale Up Threshold | Yes | 0.7 | Utilisation (0 – 1) triggering scale-up. |
| Scale Down Threshold | Yes | 0.3 | Utilisation triggering scale-down. |
| Cooldown Seconds | Yes | 300 | Min wait between actions. |
| Scaling Provider | Yes | — | hetzner / aws / custom. |
| Scaling Config | No | — | Provider-specific JSON. |
Rate limiting
TelAPI applies IP-based server protection by route tier. Limits are stored in this config, cached in Redis, and reloaded automatically when you save (revision key voiceai:api-server-config:rev). /health and /metrics are always exempt.
| Field | Default | Description |
|---|---|---|
| Rate Limit Enabled | true | Master toggle for all tiers except health. |
| API Rate Limit Max | 600 | Max requests per client IP per window for authenticated API routes. |
| API Rate Limit Window (ms) | 60000 | Window for the API tier (60 000 = one minute). |
| Webhook Rate Limit Max | 3000 | Max requests per client IP per window for /api/v1/webhooks/*. |
| Webhook Rate Limit Window (ms) | 60000 | Webhook window. Leave empty to inherit the API tier values. |
Auth routes (/api/v1/auth/*) use a fixed preset of 20 requests per minute per client IP until dedicated fields are added here.
When a tier limit is exceeded, TelAPI returns 429 Too Many Requests with error.code: RATE_LIMIT_EXCEEDED and optional details (max, after, ttlMs). See Errors.
TelAPI no longer reads RATE_LIMIT_MAX or RATE_LIMIT_WINDOW_MS. Remove them from the API service env bundle after upgrade. The former Per API Key toggle is also removed — server protection is always keyed by client IP + route tier.
This screen controls platform-wide server protection. Teams also have per-team daily quotas under Users and teams → API Access Configuration. A request can hit either limit independently.
Workflows
Configure rate limiting
Enable the config → toggle Enable Rate Limiting → set API max/window → optionally set webhook max/window → save. Changes apply to running TelAPI instances without a container restart.
Enable auto-scaling
Enable the config → toggle Scaling on → set min/max/thresholds/cooldown/provider/config → save.