# X_RATE_LIMIT_SCOPE_UNSET

## Means

the deployment has not said where the rate limiter keeps its counters

## Typical cause

an enabled `rateLimit` with no `scope`, at `defineHttpConfig`. Reachable only from an embedder that builds its own config: `scope` is boot-owned, so `configureHttp()` type-refuses it and a process booted by `x dev` or `apps/web/server.ts` DERIVES it from the store it installed. `scope` used to **default** to `'process'`, so `login: { limit: 5 }` against the 3 `web` replicas this repo's own chart ships enforced 15 per window, with a green `x verify` and nothing anywhere to read. `assertRateLimitScope` only ever fired for an app that said `'shared'`, so the silent case was exactly the one nobody declared. One process is still a legal answer; it is no longer an assumed one

## Fix

`defineHttpConfig({ rateLimit: { scope: 'process' } })` if this app runs as ONE replica, or `scope: 'shared'` plus `httpServer({ routes, rateLimitStore: postgresRateLimitStore({ executor }) })` for a fleet-wide limit

[HTTP](/error-codes#http)