Limits

How many calls each interface takes, and what a refusal looks like.

API v2 counts per account, authentication and Connect per address. Only API v2 buckets say how long to wait; the domain quota, daily key quota and Connect do not.

API v2 per account

Bucket Cap Window Counts
requests 300 per minute Every authenticated call
action 600 per minute Every action dispatch
keys-create 200 per hour create-keys
keys-export 30 per minute export-keys
keys-bulk 120 per hour Bulk key operations
soft-update 120 per hour edit-soft, reset-soft-hash
soft-create 10 per hour create-soft, delete-soft
bans 240 per hour ban-device, unban-device
cipher-keys 5 per hour rotate-cipher-keys
users-reset 10 per hour reset-user-password
domain-update 120 per hour edit-domain
template-create 50 per hour create-key-template
users-create 50 per hour create-user, create-referral, create-referral-code, delete-referral-code
users-update 240 per hour edit-user
users-delete 60 per hour delete-user
users-status 240 per hour block-user, unblock-user
users-sessions 120 per hour kick-user-sessions
domain quota 5 per hour create-domain, delete-domain, failed TXT checks included

API v2 per address

Bucket Cap Window Counts
authentication_failures 120 per minute Lookups with a wrong or blocked key
authentication_lookups 1,200 per minute Every key lookup

The 429 answer

details holds the bucket, its cap, its window and retry_after_seconds. Retry after that many seconds.

429 Too Many Requests
{
    "ok": false,
    "error": "rate_limited",
    "message": "rate limit exceeded — slow down",
    "details": {
        "bucket": "keys-create",
        "cap_per_window": 200,
        "window_seconds": 3600,
        "retry_after_seconds": 1712
    }
}

Daily key quota

Keys issued per calendar day, counted across the panel and create-keys. A request may issue up to 1,000 keys. Past the quota the answer is 429 with daily_key_limit.

Counted Keys per day
Per Software Owner account, in each software 2,500
Per software, all accounts together 50,000

Connect

Interface Counted Cap
Connect Per IP address 300 requests per minute
Connect Per software and IP 120 requests per minute
Connect Per device id 15 requests per minute

Body size

Interface Largest body Over the limit
API v2 1 MB 413 with request_too_large
Connect 4,096 bytes 413 with Request too large
Esc