Skip to main content
Every API key is rate limited per minute. The limit is applied per key, so one key’s traffic never eats into another’s.

​
Limits

Secret and publishable keys are two separate classes with their own default: a publishable key gets the higher 120/minute default because it’s meant to be called directly from a browser, where many users share the same key. Both defaults can be overridden per key (under advanced options when you create or edit it). An OAuth access token, minted for a connected app or the MCP, always uses the secret-key default and has no per-token override. Separately, each key may have at most a small number of concurrent runs in flight at once.

​
Rate-limit headers

Successful responses include headers describing your current window, and a 429 adds Retry-After:

​
When you’re rate limited

Exceeding the per‑minute limit (or the concurrent‑run limit) returns 429 Too Many Requests:
The response carries a Retry-After header (in seconds) and X-RateLimit-Remaining: 0.
Read X-RateLimit-Remaining proactively and slow down as it approaches 0. On a 429, wait the Retry-After interval before retrying, and apply exponential backoff with jitter if you keep getting limited. Keep your in‑flight runs below the key’s concurrency limit.

​
Spend caps are separate

A rate limit caps how often you call; a daily spend cap caps how many credits a key burns per day. Hitting the spend cap returns 402, not 429. See Errors for the full status‑code table.
Last modified on August 29, 2026