# Rate limits

> Per-minute request limits and how to stay under them.

Source: https://docs.coline.app/api/rate-limits

Limits count requests per credential in fixed one-minute windows. Reads (`GET`) and writes (`POST`, `PUT`, `PATCH`, `DELETE`) have separate budgets.

| Credential                     | Reads per minute | Writes per minute | Counted per          |
| ------------------------------ | ---------------- | ----------------- | -------------------- |
| API key                        | 300              | 60                | Key                  |
| OAuth token or browser session | 200              | 40                | Person and workspace |

## Headers

Rate-limited responses carry:

| Header                  | Meaning                                       |
| ----------------------- | --------------------------------------------- |
| `X-RateLimit-Limit`     | The budget for this kind of request           |
| `X-RateLimit-Remaining` | Requests left in the current window           |
| `X-RateLimit-Reset`     | Unix time, in seconds, when the window resets |

When you go over, the API returns `429` with `RATE_LIMIT_EXCEEDED`. Wait until `X-RateLimit-Reset`, then retry.

## Staying under the limit

* Read `X-RateLimit-Remaining` and slow down before it reaches zero.
* Use list routes with a sensible `limit` instead of fetching items one at a time.
* Spread background syncs across the minute instead of bursting at the start.
* Use separate keys for separate services, since each key has its own budget.

## Other limits

* **Tab** completions are also limited by the workspace's API credit balance. See [Tab](/api/tab).
* **MCP** requests have a 30-second deadline each. See [MCP](/api/mcp).
* **Apps** built with the SDK have per-install limits on capability calls, network requests and daily executions. See the [SDK reference](/sdk/reference#runtime-limits).
* **Upstream** has its own limits on `api.upstream.codes`: 15,000 requests an hour with a token, 1,000 without. See [Upstream](/upstream#api).