Skip to main content
Each key has its own window: 120 requests per 60 seconds by default. It is an operational abuse ceiling, not a plan quota. Usage itself is metered by the owner’s balance, not by this counter, and keys of the same owner do not share the window. Authentication runs before the limiter, so an unauthenticated request never spends a key’s budget.

Headers

Every response, success or failure, carries the state of the window: When the window is exhausted the API answers 429 rate_limit_exceeded and adds Retry-After (seconds).

When the limiter itself is down

The limiter fails closed. If its backing store is unavailable, the API answers 503 api_rate_limit_unavailable with Retry-After: 5 instead of letting requests through unmetered, and instead of a misleading 429. Treat it like any other transient error: wait and retry with the same Idempotency-Key.
Do not spread traffic across several keys of the same agent to lift the ceiling. Each key has its own conversations, so the same end user would end up with a fragmented history. If you need a higher limit, contact us.

Client-side pacing