> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.respona.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.respona.com/_mcp/server.

# Rate Limits

The API is rate-limited to protect it from bursts and abuse. Limits are enforced **globally across all servers**, so
they behave consistently no matter which instance serves a request.

## The limits

Two windows apply to the Orders surface:

| Scope         | Approximate limit       | Purpose                             |
| ------------- | ----------------------- | ----------------------------------- |
| Per API key   | \~60 requests / minute  | Your key's steady-state budget.     |
| Per source IP | \~600 requests / minute | A pre-auth backstop against floods. |

Both are fixed one-minute windows. Exact values are configurable and may be tuned; **always read the response headers**
rather than hard-coding a number.

## Response headers

Every response (not just `429`s) carries the current budget:

| Header                  | Meaning                                     |
| ----------------------- | ------------------------------------------- |
| `X-RateLimit-Limit`     | Max requests allowed in the current window. |
| `X-RateLimit-Remaining` | Requests remaining in the current window.   |
| `X-RateLimit-Reset`     | When the window resets.                     |

On a `429`, an additional `Retry-After` header tells you how long to wait.

## Handling 429

When you exceed a limit you get `429 Too Many Requests` in the standard [error envelope](/guides/api-conventions/errors) with code
`RATE_LIMITED`:

```json
{ "error": { "code": "RATE_LIMITED", "message": "Rate limit exceeded.", "request_id": "req_01H..." } }
```

Back off and retry after the `Retry-After` interval. Best practice:

* Respect `Retry-After`; add jitter to avoid synchronized retries.
* Watch `X-RateLimit-Remaining` and slow down before you hit zero.
* Poll [status](/guides/core-concepts/polling-for-status) on a relaxed cadence - it's the most common source of avoidable request volume.