---
title: Rate limits
description: Per-key API rate limits by plan, rate limit response headers,
  request size caps, and how to handle 429 responses.
lastModified: "2026-08-21T17:08:33+01:00"
lastAuthor: Kaylee
---
Every Inth API key has a per-key rate limit, applied when the key is created and enforced on every authenticated request. The limit depends on your organization's plan at the time the key is minted.

## Limits by plan

|Plan|Requests per minute|
|--|--|
|Starter|600|
|Pro|1,500|
|Enterprise|3,000|

API access requires the Starter plan or higher. On Free plans, creating a key and calling the API both return `402` with error code `PLAN_REQUIRED`. If an organization downgrades below Starter, existing keys stop working immediately but are not deleted — they resume when the plan is upgraded again.

A key keeps the limit it was minted with. After a plan upgrade, [roll the key](/docs/rest-api/auth/roll-api-key) or [mint a new one](/docs/rest-api/auth/create-api-key) to pick up the higher limit.

## Rate limit headers

Authenticated responses include headers so clients can pace themselves before hitting the limit:

|Header|Meaning|
|--|--|
|`X-RateLimit-Limit`|The key's requests-per-minute limit.|
|`X-RateLimit-Remaining`|Requests remaining in the current window.|
|`X-RateLimit-Reset`|When the window resets, as a Unix timestamp in seconds.|

Every response also carries an `X-Request-Id` header. Include it when reporting an issue.

## Handling 429 responses

When a key exceeds its limit, the API responds with `429` and error code `RATE_LIMITED`:

```json
{
	"success": false,
	"error": {
		"code": "RATE_LIMITED",
		"message": "API key rate limit exceeded"
	}
}
```

The response includes a `Retry-After` header with the number of seconds to wait. Back off until then instead of retrying immediately; retries inside the window also count against the limit.

## Device authorization limits

The unauthenticated device authorization endpoints are limited per client IP instead of per key:

|Endpoint|Limit|
|--|--|
|`POST /v1/auth/device/code`|10 requests per minute|
|`POST /v1/auth/device/token`|30 requests per minute|

The token endpoint limit leaves headroom for the standard \~5 second polling interval.

## Other limits

|Limit|Behavior when exceeded|
|--|--|
|Request bodies up to 1 MB|`413` with error code `PAYLOAD_TOO_LARGE`|
|50 API keys per organization|`409` with error code `KEY_LIMIT_REACHED`; delete unused keys first. Rolling a key replaces it, so rolling works at the cap.|