Skip to content

API & developers

Rate limits

How many requests and orders you can make per minute, the headers that show where you stand, and how to back off.

Last updated
Updated
Reading time
1 min read
On this page3
  1. The limits
  2. Headers
  3. Handling 429s

Limits keep the service fast for everyone. They're generous for normal use, and responses tell you where you stand.

The limits

What Limit Counted per
API requests 120 per minute API key
New orders 20 per minute Account (web and API together)
New rentals 10 per minute Account
Sign-in, sign-up and password-reset attempts 10 per minute IP address

Windows are fixed: a window opens with your first request and resets one minute later. The order and rental limits count only purchases that go through: a request refused for, say, no stock or a low balance doesn't use up your allowance.

Headers

API responses include:

Header Meaning
X-RateLimit-Limit Requests allowed per window.
X-RateLimit-Remaining Requests left in the current window.
X-RateLimit-Reset When the window resets, as a Unix timestamp in seconds.

Go over a limit and you get HTTP 429 with the error code rate_limited, plus a Retry-After header saying how many seconds to wait. When the limit you hit is the order or rental limit, the X-RateLimit-* headers on that response describe that limit, not the per-key request limit.

Handling 429s

  • Wait for Retry-After seconds, then retry. Never retry in a tight loop.
  • Polling an order every 2–5 seconds is plenty — or use webhooks and don't poll at all.
  • Always send an Idempotency-Key when creating orders and rentals, so retries can't double-buy.

Note

Need more headroom for a legitimate workload? Email support@passcode.sh and tell us about it.