Security

Enhanced API rate limiting

We've implemented stricter API rate limiting to protect against abuse and ensure fair usage.

Rate limits

Endpoint typeLimit
Authenticated API100 requests/min
Public endpoints30 requests/min
Webhook deliveries10 requests/min per project

How it works

  • Limits are tracked per-IP for public endpoints and per-API-key for authenticated ones

  • Exceeding the limit returns 429 Too Many Requests

  • The response includes a Retry-After header telling you when to try again

Response example

{
  "error": "Rate limit exceeded",
  "retryAfter": 23,
  "limit": 100,
  "remaining": 0
}

Legitimate usage should never be affected. If you need higher limits for your use case, contact us about Enterprise plans.

Back to changelog