Rate limits

Limits count per account, over one minute. All your API keys share them.

Endpoints	Requests per minute
Purchase	20
Plans, regions	30
Top-up	30
Cancel	30
Fulfil	60
Balance	100
Everything else	100

Each row is its own budget. Polling your balance does not use up the budget for buying.

Headers

Answers carry these headers, except on AUTH_ERROR, NOT_FOUND, PAYLOAD_TOO_LARGE and INTERNAL_ERROR:

Header	Meaning
X-RateLimit-Limit	The limit for this endpoint.
X-RateLimit-Remaining	Requests left in the current minute.
X-RateLimit-Reset	When the minute resets, as a Unix timestamp in seconds.
Retry-After	Only on a refusal: how many seconds to wait.

When you hit a limit

You get 429 with the code RATE_LIMITED:

{
  "success": false,
  "error": {
    "code": "RATE_LIMITED",
    "message": "Rate limit exceeded. Please wait 12 seconds before retrying."
  }
}

Wait for Retry-After, then try again.

Failed sign-ins

Refused requests (401 and 403) are limited per IP address: 10 a minute for the same key, and 60 in 15 minutes in total. After that you get 429 until the window passes. Accepted requests do not count toward this.