Rate limits
How many requests a key and a business can send, and what a 429 looks like.
Every call to /api/v1 counts against two limits at once. By default:
| Limit | Allowance | Counts |
|---|---|---|
| Per API key | 600 requests a minute | Every request made with that key |
| Per business | 3,000 requests a minute | Every request from all of the business's keys, test and live together |
Each limit is a bucket that holds a minute's allowance and refills continuously, so a key can burst to 600 at once and then sustains 10 a second. A request that fails authentication is answered 401 before either bucket is touched.
Headers
A response from /api/v1 carries the bucket it was counted against:
| Header | Value |
|---|---|
X-RateLimit-Limit | The size of the bucket |
X-RateLimit-Remaining | Requests left in it right now |
Retry-After | On a 429 only: whole seconds until a request fits again |
A request that passes both limits reports the business bucket. A 429 reports the bucket that ran out.
When you are limited
The answer is 429 with the code RATE_LIMITED:
{
"success": false,
"code": "RATE_LIMITED",
"message": "Too many requests",
"data": null
}Wait Retry-After seconds and send the request again. A 429 is answered before the Idempotency-Key is read, so a vend that was limited was not placed: retry it with the same key and the same body.