Skip to main content
The API enforces rate limits at two levels: per IP address (all requests) and per API key (authenticated requests). Both use a sliding-window counter backed by Redis.

​
IP-based rate limiting

Every request is rate-limited by source IP, regardless of authentication. These limits apply per IP address. If multiple API keys share the same IP (e.g. corporate NAT), they share this budget.

​
API key rate limiting

Authenticated requests are additionally rate-limited per API key. These limits are configured per key and depend on your plan. Your actual limits may differ from the defaults above depending on your plan.

​
Response headers

Every response includes rate-limit headers so you can track your usage:

​
Error responses

When a rate limit is exceeded, the API returns 429 Too Many Requests with a JSON body:
The Retry-After header is also set, indicating how many seconds to wait before retrying.

​
Possible rate-limit errors

​
Best practices

Monitor X-RateLimit-Remaining and X-RateLimit-Remaining-Minute headers to proactively throttle before hitting limits.
  • Use exponential backoff — when you receive a 429, wait for the Retry-After duration before retrying.
  • Consolidate IPs — if you run distributed workers, be aware of the unique IP limit per key.
  • Use POST multi-search — combine multiple queries into a single request where possible.