Rate Limiting

Limits

Rate limits are configurable per account, not per API key — if you hold multiple keys (up to 5), they share one limit. Limits are tracked per account, not per IP address. New accounts start with the following defaults:

• 20 requests per minute — resets at the top of every minute (UTC)
• 300 requests per day — resets at midnight UTC

Both windows are fixed clock buckets rather than rolling ones, so you can spend a full minute's allowance at the end of one minute and the next minute's allowance immediately after.

The per-minute limit is enforced approximately. Requests sent at the same time all read the same count, so a short burst can slip past the limit. Every request is still counted, so the burst spends the minute's allowance early rather than adding to it, and the next request is rejected. The daily limit is exact.

Need more throughput for a specific integration? Get in touch and we can raise the limits on your account.

What Counts Against Your Limits

A request is counted as soon as it passes authentication and rate limiting — before the endpoint runs. A request that then answers 400 or 404 has already spent one request from both budgets.

• 401 responses don't count — authentication runs before the rate limiter
• 429 responses don't count — a rejected request is tracked separately and doesn't spend your budget

Rate Limit Headers

Successful responses include headers showing your current rate limit status:

X-RateLimit-Limit-Minute: 20
X-RateLimit-Limit-Day: 300
X-RateLimit-Remaining-Minute: 18
X-RateLimit-Remaining-Day: 295
X-RateLimit-Reset: 2026-02-05T12:01:00.000Z

Exceeding the Limit

When you exceed either rate limit, the API returns a 429 Too Many Requests response with a Retry-After header indicating how many seconds to wait:

{
  "error": {
    "status": 429,
    "message": "Rate limit exceeded (per minute)",
    "code": "RATE_LIMITED"
  }
}

The message names the window you hit — (per minute) or (per day). The Retry-After header value is in seconds. Wait at least that long before retrying. A 429 response also carries the X-RateLimit-* headers above, so you can read your remaining budget and the next reset time straight off the rejected request.