What if someone opens 2 tabs, sends concurrent requests, or calls your API directly without a key? That's why you also need a UNIQUE constraint on the email column. Without it, two requests can both…

Do this instead: Request ↓ Rate-limit check ↓ Reject if over the limit ↓ Argon2id / bcrypt verification Check the cheap constraint before doing the expensive work.