Skip to main content
The Developer API rate-limits requests using a moving-window strategy backed by Redis. Limits are applied per authenticated tenant + endpoint.

​
Limits

Specifically:

​
When you exceed a limit

A request that exceeds its limit returns 429 Too Many Requests with this body:
The 429 response includes these headers:
These rate limit headers are only returned on 429 responses. Successful 2xx responses currently do not carry X-RateLimit-* headers – clients should pace themselves based on their own counters or back off when they see a 429.

​
Retry strategy

On 429, wait for Retry-After seconds (or fall back to a few seconds of exponential backoff if the header is missing) and retry the same request. Voucher creation and customer creation are not automatically idempotent – if you retry a POST after a network timeout, use the Idempotency page to understand what is and isn’t deduplicated.