ladill-frontdesk/app/Providers/AppServiceProvider.php

<?php

namespace App\Providers;

use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\RateLimiter;
use Illuminate\Support\ServiceProvider;

class AppServiceProvider extends ServiceProvider
{
    public function register(): void
    {
        //
    }

    public function boot(): void
    {
        RateLimiter::for('kiosk-device', function (Request $request) {
            $key = $request->route('token')
                ?? $request->header('X-Device-Token')
                ?? $request->ip();

            return Limit::perMinute(30)->by((string) $key);
        });

        RateLimiter::for('qr-scan', fn (Request $request) => Limit::perMinute(20)->by($request->ip()));

        RateLimiter::for('device-heartbeat', function (Request $request) {
            return Limit::perMinute(60)->by((string) ($request->header('X-Device-Token') ?? $request->ip()));
        });
    }
}