Rate Limits

Limits

Each API token is limited to 600 requests per 60-second window by default (a fixed window per token). Self-hosted deployments can change this via the API_RATE_LIMIT_MAX and API_RATE_LIMIT_WINDOW_MS environment variables.

Response headers

Every response — success or error — carries:

• X-RateLimit-Limit — the window's request cap
• X-RateLimit-Remaining — requests left in the current window
• X-RateLimit-Reset — epoch seconds when the window resets

Handling 429s

A 429 response uses the standard error envelope with error.code: "rate_limited". Back off until the time in X-RateLimit-Reset, ideally with jitter, before retrying.