Rate Limiting

Limits

Rate limits are evaluated over a 60-second window.

Request type	API key limit	Account limit
Failed authentication attempts	10 per minute	Not applicable
GET requests	100 per minute	300 per minute
POST, PUT, DELETE requests	20 per minute	60 per minute

How limits are applied

Authenticated requests use two buckets: one for the API key and one for the authenticated account. The account limit is tracked separately for each account, route, and HTTP method. The response headers show the most restrictive active limit for that request. Authentication uses a separate limiter, and only failed login attempts count toward it. Any request over the limit returns a 429 Too Many Requests response.

Rate limit headers

Responses include standard rate limit headers.

Header	Description
`RateLimit-Policy`	The current request limit and time window
`RateLimit-Limit`	The maximum number of requests allowed in the active window
`RateLimit-Remaining`	The number of requests still available in the active window
`RateLimit-Reset`	The number of seconds until the window resets
`Retry-After`	Returned on `429` responses with the number of seconds to wait before retrying

Example response headers:

RateLimit-Policy: 100;w=60
RateLimit-Limit: 100
RateLimit-Remaining: 30
RateLimit-Reset: 53

Getting Started

API Overview

Limits

How limits are applied

Rate limit headers

​Limits

​How limits are applied

​Rate limit headers

Limits

How limits are applied

Rate limit headers