Rate limits
Limits protect the APIs for everyone. They are counted per caller and per API:
| Caller | Counted by | Default limit |
|---|---|---|
| Authenticated | your user (or your key) | 600 requests / minute per API |
| Anonymous | client IP address | 60 requests / minute per API |
Some endpoints have their own, stricter limits:
| Endpoint | Limit |
|---|---|
/dash/v2/auth/*, /dash/v2/users/*/password/… |
10 / minute per IP |
/dash/oauth/token, /dash/v2/oauth/token |
20 / minute per IP |
/workflows/workflows/run, /workflows/workflows/run/stream |
30 / minute per user |
An IP address that repeatedly sends invalid credentials is blocked briefly (30 rejected credentials per minute).
Health checks and webhook receivers aren't rate limited.
Headers
Every rate-limited response tells you where you stand:
RateLimit-Limit: 600
RateLimit-Remaining: 587
RateLimit-Reset: 42
RateLimit-Reset is the number of seconds until requests become available again.
The limits are sliding windows, so capacity frees up continuously rather than all
at once.
When you hit the limit
The gateway answers 429 with a rate-limited
problem and a Retry-After header (in seconds). Wait at least that long before
retrying. For bulk work, pace your requests using RateLimit-Remaining instead of
retrying in a tight loop.