Rate Limiting

The full guide is in Developers → Rate limits.

Limits

Scope	Limit
Per API key	The key's own quota, set when you create it (default 1,000 requests per hour)
Per OAuth app	The app's quota, per organization that installed it
Per client IP	20 requests per second, 200 per minute, 2,000 per hour; sign-in, password reset and similar routes are tighter

Response headers

Requests made with an API key or OAuth token carry:

RateLimit-Limit: 1000
RateLimit-Remaining: 997
RateLimit-Reset: 2712
RateLimit-Policy: 1000;w=3600

Header	Description
`RateLimit-Limit`	Requests allowed in the window
`RateLimit-Remaining`	Requests left in the window
`RateLimit-Reset`	Seconds until the window resets
`RateLimit-Policy`	The quota and the window length in seconds (`w`)

Rate limit exceeded

The API answers 429 with a Retry-After header (in seconds) and a code such as API_KEY_RATE_LIMITED or OAUTH_RATE_LIMITED.

async function fetchWithRetry(url, options, maxRetries = 3) {
  for (let attempt = 0; ; attempt++) {
    const res = await fetch(url, options);
    if (res.status !== 429 || attempt === maxRetries) return res;
    const retryAfter = Number(res.headers.get('Retry-After'));
    const delay = retryAfter ? retryAfter * 1000 : 2 ** attempt * 1000 * (0.5 + Math.random());
    await new Promise((r) => setTimeout(r, delay));
  }
}

Best practices

Pace jobs with RateLimit-Remaining instead of running into the limit.
Use the Bulk API for large loads and exports.
Use webhooks instead of polling for changes.
Retry writes only with an Idempotency-Key.

Limits

Response headers

Rate limit exceeded

Best practices

On this page