Rate Limiting

API requests are rate-limited per workspace.

The limit

Every workspace can make up to 60 requests per minute, regardless of plan. The limit is shared across all of a workspace's API keys and OAuth tokens, so adding more keys doesn't increase your throughput.

Response headers

Every response includes rate limit headers:

Header	Description
X-RateLimit-Limit	Maximum requests per minute for your workspace
X-RateLimit-Remaining	Requests remaining in the current window
X-RateLimit-Reset	Seconds until the window resets

Exceeding the limit

When you exceed the limit, the API returns 429:

{
  "error": {
    "code": "rate_limit_exceeded",
    "message": "Rate limit exceeded"
  }
}

The response includes an additional Retry-After header with the number of seconds to wait.

OAuth endpoint limits

The OAuth token and revocation endpoints have separate IP-based rate limits:

Endpoint	Limit
POST /oauth/token	30 requests/minute per IP
POST /oauth/revoke	60 requests/minute per IP

These limits apply regardless of plan and are based on the client's IP address.

Best practices

• Check X-RateLimit-Remaining before sending bursts of requests
• Use the Retry-After header to schedule retries
• Implement exponential backoff for 429 responses
• Use webhooks instead of polling when possible