Rate limits

Each API key is allowed 60 requests per minute and 10,000 requests per day by default. Limits are enforced atomically; exceeding either bucket returns 429 Too Many Requests until the window resets.

Headers

Every response carries headers describing your current usage:

http
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 47
X-RateLimit-Reset: 1735718400
X-RateLimit-Daily-Limit: 10000
X-RateLimit-Daily-Remaining: 8214

X-RateLimit-Reset is a Unix epoch (seconds) for when the per-minute window resets. On 429 responses we also include a Retry-After header with the number of seconds to wait.

Best practices

• Check X-RateLimit-Remaining proactively and back off when low.
• On 429, respect Retry-After with exponential backoff + jitter for retries.
• Batch reads when possible — use ?limit=250 instead of paging in small chunks.
• Cache infrequent reads (categories, store profile) client-side.

429 response shape

json
{
  "error": {
    "code": "rate_limited",
    "message": "Rate limit exceeded (minute bucket). Retry in 23s.",
    "details": {
      "bucket": "minute",
      "limit": 60,
      "resetAt": "2026-05-21T14:32:00.000Z"
    }
  }
}