Rate limits

Overview

Rate limits protect the API from abuse and ensure fair usage for all users. When you exceed a rate limit, the API returns a 429 Too Many Requests response with a Retry-After header and a retryAfter field indicating how many seconds to wait before retrying.

API key rate limits

Authenticated endpoints are rate-limited per API key based on whether the endpoint is a read or write operation.

Type	Limit	Scope
Read endpoints	30 requests/second	Per API key
Write endpoints	20 requests/second	Per API key

Read endpoints are those that require X-Public-Key only. Write endpoints are those that require X-Public-Key, X-Timestamp, and X-Signature. See the Authentication guide for details. When the limit is exceeded:

{
  "message": "Rate limit exceeded. Please try again later.",
  "retryAfter": 1
}

The response also includes a Retry-After header with the number of seconds to wait.

API key management

API key management endpoints are rate-limited per session token to prevent abuse. Each user can have a maximum of 2 active API keys at any time.

Operation	Limit	Window	Scope
Create API key	2 requests	30 minutes	Per session
Revoke API key	2 requests	30 minutes	Per session
Rotate API key	2 requests	30 minutes	Per session

Rotation shares the revoke limit since it revokes the existing key and creates a new one. When the limit is exceeded:

{
  "message": "Rate limit exceeded. Please try again later.",
  "retryAfter": 900
}

The retryAfter value reflects the actual time remaining until the next request is allowed. The login endpoint (POST /v1/user/login) is rate-limited to 1 request per 2 minutes per email address.

Endpoint	Limit	Window	Scope
`POST /v1/user/login`	1 request	2 minutes	Per email address

When the limit is exceeded:

{
  "message": "Too many login attempts. Please try again later.",
  "retryAfter": 120
}

Handling rate limit errors

Node.js

async function fetchWithRetry(url, options) {
  const response = await fetch(url, options);

  if (response.status === 429) {
    const { retryAfter } = await response.json();
    console.log(`Rate limited. Retrying in ${retryAfter} seconds...`);
    await new Promise(resolve => setTimeout(resolve, retryAfter * 1000));
    return fetchWithRetry(url, options);
  }

  return response.json();
}

Best practices

Handle 429 gracefully — if you receive a rate limit response, wait for the retryAfter duration before retrying.
Cache your session token — after a successful login, store the returned token and deviceId and reuse them for subsequent API key operations. There’s no need to log in again for each request.
Don’t poll the login endpoint — the login endpoint is intended for one-time session creation, not repeated calls.
Batch where possible — if you need data for multiple markets, use list endpoints instead of making individual requests.

Getting started

Core concepts

Market makers

Support

Overview

API key rate limits

API key management

Handling rate limit errors

Best practices

​Overview

​API key rate limits

​API key management

​Login endpoint

​Handling rate limit errors

​Best practices

Overview

API key rate limits

API key management

Login endpoint

Handling rate limit errors

Best practices