Rate limits
Free accounts get 5 requests per minute; Pro accounts get 600. The limit is per account — all of your keys share it. Every response includes headers showing how many requests you have left in the current window.
Response headers
Every authenticated response carries these three:
| Header | Value |
|---|---|
X-RateLimit-Limit | Requests allowed per window (currently 600). |
X-RateLimit-Remaining | Requests left in the current window. |
X-RateLimit-Reset | Unix seconds when the window resets. |
When you exceed the limit
You get a 429 rate_limited response with a Retry-After: <seconds> header pointing at the next window boundary:
{"HTTP/1.1 429 Too Many Requests\nRetry-After: 42\n\n{\"error\":{\"code\":\"rate_limited\",\"message\":\"...\",\"retry_after\":42}}"}Fixed vs sliding window
The window is fixed, not sliding. In the worst case that means a boundary burst of about 1200 requests in one second (last second of window N plus first second of window N+1). If that boundary behavior matters for your workload, get in touch and we can switch you to a sliding window.
Edge protection
In addition to the per-account limiter, a per-IP rate limit shed volumetric junk before it reaches the app. Legitimate traffic never gets close.