thats-me/backend/app/Providers/AppServiceProvider.php

<?php

namespace App\Providers;

use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\RateLimiter;
use Illuminate\Support\ServiceProvider;

class AppServiceProvider extends ServiceProvider
{
    /**
     * Register any application services.
     */
    public function register(): void
    {
        //
    }

    /**
     * Bootstrap any application services.
     */
    public function boot(): void
    {
        $this->configureRateLimiting();
    }

    /**
     * Rate limiters for the API surface consumed by the Quasar app.
     */
    private function configureRateLimiting(): void
    {
        RateLimiter::for('api', function (Request $request): Limit {
            return $request->user()
                ? Limit::perMinute(300)->by('api|user|'.$request->user()->getAuthIdentifier())
                : Limit::perMinute(60)->by('api|ip|'.$request->ip());
        });

        RateLimiter::for('uploads', function (Request $request): Limit {
            return Limit::perMinute(30)->by('uploads|user|'.$request->user()?->getAuthIdentifier());
        });

        // Thumbnails, previews and originals. One request per image the
        // timeline shows, so this has to be far above the write budget.
        RateLimiter::for('media', function (Request $request): Limit {
            return Limit::perMinute(1200)->by('media|user|'.$request->user()?->getAuthIdentifier());
        });

        // Client-side log batches; the app sends at most one every few
        // seconds, so anything beyond this is a misbehaving client.
        RateLimiter::for('client-logs', function (Request $request): Limit {
            return Limit::perMinute(30)->by('client-logs|user|'.$request->user()?->getAuthIdentifier());
        });
    }
}