Understanding rate limit headers
3 min read Updated October 22, 2026
Headers
Every response carries the limits for your tightest window:
X-RateLimit-Limit: the maximum requests in that windowX-RateLimit-Remaining: requests leftX-RateLimit-Reset: Unix time when the window resets
The same three also appear per window with a -minute or -day suffix (for example X-RateLimit-Remaining-day). A 429 adds Retry-After.
text
HTTP/1.1 200 OK X-RateLimit-Limit: 300 X-RateLimit-Remaining: 298 X-RateLimit-Reset: 1792670696 X-RateLimit-Limit-minute: 300 X-RateLimit-Limit-day: 50000 X-RateLimit-Remaining-day: 49977
You may also see standard RateLimit-* headers. They describe a separate safety limit per client address; rely on X-RateLimit-* for your quota.
Limits
| Environment | Per minute | Per day | Per month |
|---|---|---|---|
| Sandbox | 60 | 1,000 | 10,000 (plus 50 risk-score calls) |
| Production | 300 | 50,000 | no fixed cap |
Practice
- Back off on 429 using
Retry-After - Cache data that rarely changes, such as HS lookups
- Use the batch endpoints (see *Batch endpoints for high-volume use*)
- Slow down before
X-RateLimit-Remainingreaches 0
Was this article helpful?