Rate limits

Every Inth API key has a per-key rate limit, applied when the key is created and enforced on every authenticated request. The limit depends on your organization's plan at the time the key is minted.

Limits by plan

API access requires the Starter plan or higher. On Free plans, creating a key and calling the API both return 402 with error code PLAN_REQUIRED. If an organization downgrades below Starter, existing keys stop working immediately but are not deleted — they resume when the plan is upgraded again.

A key keeps the limit it was minted with. After a plan upgrade, roll the key or mint a new one to pick up the higher limit.

Rate limit headers

Authenticated responses include headers so clients can pace themselves before hitting the limit:

Every response also carries an X-Request-Id header. Include it when reporting an issue.

Handling 429 responses

When a key exceeds its limit, the API responds with 429 and error code RATE_LIMITED:

{
	"success": false,
	"error": {
		"code": "RATE_LIMITED",
		"message": "API key rate limit exceeded"
	}
}

The response includes a Retry-After header with the number of seconds to wait. Back off until then instead of retrying immediately; retries inside the window also count against the limit.

Device authorization limits

The unauthenticated device authorization endpoints are limited per client IP instead of per key:

The token endpoint limit leaves headroom for the standard ~5 second polling interval.

Other limits