Rate Limits
Request limits and how to handle them.
Rate Limits
The API enforces rate limits per client IP address to protect the platform for everyone. Every request is checked against three overlapping windows:
| Window | Limit |
|---|---|
| 1 second | 10 requests |
| 10 seconds | 30 requests |
| 60 seconds | 100 requests |
A request only needs to exceed one of these windows to be rejected.
Some sensitive endpoints (e.g. card submission, OTP/PIN entry, submitting interest in a merchant account) apply a tighter, endpoint-specific limit on top of the defaults above. Where that applies, it's called out on the endpoint's own page.
Exceeding the Limit
When you exceed a limit, the API responds with 429 Too Many Requests:
{
"statusCode": 429,
"message": "ThrottlerException: Too Many Requests"
}Back off and retry after a short delay. If you're regularly hitting these limits during normal integration use (not a burst/retry bug on your end), get in touch — the defaults are tuned for typical usage, not high-volume platforms.