429 Too Many Requests response. Design your integration to read the rate limit headers on every response and back off before the limit is reached — not after.
Request Limits
Each API key has the following budget:
The per-minute limit applies on a rolling basis, not a fixed clock boundary. The burst limit allows short spikes in traffic but prevents sustained overload. Both limits are enforced independently — exceeding either triggers a
429.
Rate Limit Headers
Every API response includes three headers that report your current usage:
Example response headers:
429 Response
When you exceed the rate limit, the API returns: HTTP 429 Too Many RequestsRetry-After header with the number of seconds to wait before retrying. Honor this value — retrying immediately will continue to return 429 and consume your quota for the burst window.
Handling 429 in Code
Implement exponential backoff with a maximum retry count. The following JavaScript example reads theRetry-After header and waits accordingly:
rate-limit-handler.js
Best Practices
- Read headers, don’t guess. Always inspect
X-RateLimit-Remainingrather than assuming your request count is safe. - Use bulk endpoints. Where available, prefer endpoints that accept arrays of resources over looping individual calls.
- Queue background jobs. For high-volume operations, use a task queue with a rate-limited worker rather than making synchronous API calls from a user-facing request path.
- Avoid concurrent bursts. Fan-out patterns that fire many parallel requests simultaneously are the most common cause of hitting the burst limit.
What’s Next
Authentication
Set up API key authentication and learn key rotation best practices.
Error Codes
See the full error code reference, including how to handle 500-level server errors with backoff.