Skip to main content

Rate Limits

Rate limits protect the API from abuse and ensure fair usage. When you exceed a rate limit, the API returns a 429 Too Many Requests response.

Rate Limit Headers

API responses include headers to help you track your rate limit usage:

Header Description
X-RateLimit-Limit Maximum requests allowed in the current window
X-RateLimit-Remaining Requests remaining in the current window
Retry-After Seconds until the rate limit resets (only on 429 responses)

Public Endpoints

Endpoints that don't require authentication (per IP address)

Public API

30 / 1 minute
/v1/health, /v1/schemas/*, /v1/verifier/presentations/verify

Authenticated Endpoints

Standard API endpoints (per API key)

General API

60 / 1 minute
Most authenticated endpoints

Credential Creation

60 / 1 minute
POST /v1/issuer/credentials

Batch Operations

30 / 1 minute
Revoke, suspend, reinstate batch endpoints

Sensitive Operations

Operations that modify account configuration (per API key)

Account Configuration

5 / 1 minute
Domain, signing key, and API key management

Automation Triggers

10 / 1 minute
POST /v1/issuer/automations/:id/trigger

Data Source Testing

5 / 1 minute
POST /v1/issuer/data_sources/:id/test

OpenID4VCI

Credential issuance protocol endpoints (per client)

Dynamic Client Registration

10 / about 1 hour
POST /oid4vci/register

Nonce

60 / 1 minute
POST /oid4vci/nonce

Token

60 / 1 minute
POST /oid4vci/token

Credential

60 / 1 minute
POST /oid4vci/credential

Deferred Credential

30 / 1 minute
POST /oid4vci/deferred_credential

OpenID4VP

Credential presentation protocol endpoints (per client)

Presentation Request

30 / 1 minute
GET /openid4vp/requests/:uuid

VP Response

30 / 1 minute
POST /openid4vp/response

Authentication

Login and password reset endpoints (per IP address)

Login Attempts

5 / 1 minute
POST /users/sign_in

Password Reset

3 / 5 minutes
POST /users/password

Best Practices

  • Monitor the X-RateLimit-Remaining header to avoid hitting limits
  • Implement exponential backoff when you receive a 429 response
  • Use batch endpoints when available instead of making many individual requests
  • Cache responses where appropriate to reduce API calls