# `OWUITOOLS_GITHUB_TOKEN` — lifts the rate limit on `lookup_package`

Five minutes. Free. **Optional** — the tool works without it.

## Why

`lookup_package` checks GitHub releases as one of its sources. Unauthenticated GitHub
allows **60 requests per hour per IP**, and that is for the whole stack, not per user — a
single conversation that asks about a handful of packages can exhaust it. A token with no
scopes at all raises it to **5,000 per hour**.

## Steps

1. Go to <https://github.com/settings/tokens> → **Generate new token (classic)**.
2. Give it a name like `owuitools`.
3. **Select no scopes.** None are needed: it only reads public data, and a token with no
   scopes cannot do anything else if it leaks.
4. Set an expiry you are willing to renew.
5. Copy the token — GitHub shows it once.
6. Put it in `configs/owuitools.env`:

   ```
   OWUITOOLS_GITHUB_TOKEN=ghp_...
   ```

7. `docker compose up -d api`

## Checking it

```sh
./tests/try-tool.sh lookup_package '{"name": "ripgrep", "ecosystem": "github"}' | head -5
```

If you were rate-limited, the tool says so in words rather than failing.