Rate limits
Request limits per identity and per IP, in 60-second windows.
| Identity | Limit per 60-second window |
|---|---|
| Validated API key (summed across endpoints) | 300 |
| Public routes, per IP | 120 |
| Whole tenant (all keys and sessions together) | 600 |
| Pre-authentication protection, per IP | 1200 |
Sensitive routes have extra per-route budgets on top of the general limit: OTP, magic link, OAuth and Turnstile (10 to 30 per minute per IP), MCP client registration, token and revocation (10 to 30 per minute per IP), and the costly authenticated routes POST /invoices, POST /invoices/calculate (120 per minute per tenant), POST /invoices/batches (10 per minute per tenant) and certificate upload (10 per minute per tenant). Health checks, preflight and Stripe receiving are exempt. Creating more API keys does not raise your ceiling: the tenant-wide limit applies across all of them.
Headers: X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (Unix timestamp in seconds). On 429, the Retry-After header gives the seconds until you can retry and the body carries code: "ERROR_RATE_LIMIT_EXCEEDED". On sensitive routes, the route-specific headers replace the general ones.