api auth limits