Rate limits

Every plan can use the API and MCP. The plan decides how much: each organization API key carries a per-key rate limit, applied when the key is created and enforced on every authenticated request, and each plan caps how many keys an organization can hold.

Limits by plan

A key keeps the limit it was created with. After a plan upgrade, roll the key or create a new one to pick up the higher limit.

Rate limit headers

Authenticated responses include headers so clients can pace themselves before hitting the limit:

Every response also carries an X-Request-Id header. Include it when reporting an issue.

Handling 429 responses

When a key exceeds its limit, the API responds with 429 and error code RATE_LIMITED:

{
	"success": false,
	"error": {
		"code": "RATE_LIMITED",
		"message": "API key rate limit exceeded"
	}
}

The response includes a Retry-After header with the number of seconds to wait. Back off until then instead of retrying immediately; retries inside the window also count against the limit.

User token limits

A user token obtained through the OAuth device grant is limited per person rather than per key, at 600 requests per minute across every organization the person can reach. Plan-gated options still apply to each call: for example, removing consent banner branding answers 402 with PLAN_REQUIRED on a plan that does not include it, whichever kind of token is used.

The device authorization and token endpoints are limited per client IP. Clients should poll at the interval returned by the device authorization request and honor Retry-After when an endpoint returns 429.

Other limits