Rate Limits

Two independent limits apply to every authenticated request:

• Per-key limit — each API key is limited to 100 requests per minute. The counter resets at the start of each UTC minute. Exceeding it returns 401.
• Service-level throttle — a shared cap across all keys in the environment. In total it is 500 concurrent in-flight requests (burst) and 100 requests/second steady state. Exceeding it returns 429.

Note: A per-key rate-limit rejection returns 401, not 429. If an integration reports intermittent 401 errors under load, check request volume before assuming the key is invalid.

Retry recommendation for integrators:

1. On 401 (suspected rate limit) or 429, wait 1 second and retry.
2. Double the wait on each subsequent retry (exponential back-off).
3. Give up after 3 retries and surface the error.