Core concepts
Rate limits
Authenticated quotas protect credentials and organizations, while a separate IP limiter handles broad abuse.
Quota model
After authentication, every request consumes a credential quota. Deployments can also enable an aggregate organization ceiling. Scope failures consume authenticated quota; invalid credentials do not create identity buckets.
Quota values are deployment-configured and may differ between environments. Do not hard-code an assumed request rate.
Response headers
| Header | Description |
|---|---|
RateLimit-Limit | Effective fixed-window limit |
RateLimit-Remaining | Requests remaining in the window |
RateLimit-Reset | Seconds until the bucket resets |
Retry-After | Seconds to wait after a 429 |
Handling 429
Stop sending requests for at least the duration in Retry-After. Add jitter before retrying, cache safe resource data where appropriate, and avoid synchronized bursts across workers.