Rate limits
Every account gets 600 requests per minute. The limit is per account, so all of your keys share it. Every response includes headers showing how many requests you have left in the current window. Requests without an API key are limited per IP instead: 600 per minute when they carry an x402 payment, 60 per minute when they do not.
Response headers
Every authenticated response carries these three:
| Header | Value |
|---|---|
X-RateLimit-Limit | Requests allowed per window (currently 600). |
X-RateLimit-Remaining | Requests left in the current window. |
X-RateLimit-Reset | Unix seconds when the window resets. |
When you exceed the limit
You get a 429 rate_limited response with a Retry-After: <seconds> header pointing at the next window boundary:
HTTP/1.1 429 Too Many Requests
Retry-After: 42
{"error":{"code":"rate_limited","message":"...","retry_after":42}}
Fixed vs sliding window
The window is fixed, not sliding. In the worst case that means a boundary burst of about 1200 requests in one second (last second of window N plus first second of window N+1). If that boundary behavior matters for your workload, get in touch and we can switch you to a sliding window.
Edge protection
In addition to the per-account limiter, a per-IP rate limit shed volumetric junk before it reaches the app. Legitimate traffic never gets close.