API
Rate limits
Per-minute request limits and how to stay under them.
Limits count requests per credential in fixed one-minute windows. Reads (GET) and writes (POST, PUT, PATCH, DELETE) have separate budgets.
| Credential | Reads per minute | Writes per minute | Counted per |
|---|---|---|---|
| API key | 300 | 60 | Key |
| OAuth token or browser session | 200 | 40 | Person and workspace |
Headers
Rate-limited responses carry:
| Header | Meaning |
|---|---|
X-RateLimit-Limit | The budget for this kind of request |
X-RateLimit-Remaining | Requests left in the current window |
X-RateLimit-Reset | Unix time, in seconds, when the window resets |
When you go over, the API returns 429 with RATE_LIMIT_EXCEEDED. Wait until X-RateLimit-Reset, then retry.
Staying under the limit
- Read
X-RateLimit-Remainingand slow down before it reaches zero. - Use list routes with a sensible
limitinstead of fetching items one at a time. - Spread background syncs across the minute instead of bursting at the start.
- Use separate keys for separate services, since each key has its own budget.
Other limits
- Tab completions are also limited by the workspace's API credit balance. See Tab.
- MCP requests have a 30-second deadline each. See MCP.
- Apps built with the SDK have per-install limits on capability calls, network requests and daily executions. See the SDK reference.
- Upstream has its own limits on
api.upstream.codes: 15,000 requests an hour with a token, 1,000 without. See Upstream.