---
title: Rate limits
description: How many requests you can make, the headers that report your quota, and how to handle a 429.
---

Requests are limited per caller to **100 per minute** on a sliding window. Sustained traffic is also smoothed at the edge to roughly 60 per minute, with short bursts above that tolerated. Stay under one request per second sustained and you won't hit either limit.

Every response reports your quota:

| Header | Meaning |
| --- | --- |
| `X-RateLimit-Limit` | Requests allowed in the current window. |
| `X-RateLimit-Remaining` | Requests left in the current window. |
| `X-RateLimit-Reset` | Unix time (seconds) the window resets. |

Going over returns `429 Too Many Requests` with a `Retry-After` header in seconds:

```json
{
  "success": false,
  "message": "Too many requests. Please retry after 60 seconds.",
  "data": null
}
```

Wait for `Retry-After` before retrying, and use `X-RateLimit-Remaining` to slow down before you get cut off. A `429` is rejected before anything is created, so retrying with the same `external_reference` is always safe.

:::tip
Don't poll for results in a tight loop. Use [webhooks](/docs/concepts/webhooks), and poll only as a fallback.
:::