Rate Limits

Rate limits are enforced per API key. There are two independent windows — per-minute and per-day.

Limits

Window	Limit
Per minute	60 requests
Per day (UTC)	5,000 requests

Both windows are checked on every request. A request is rejected if either limit is exceeded.

Response Headers

Every API-key-authenticated response includes these headers:

Header	Description
`X-RateLimit-Limit`	The limit for the active window (60 or 5000)
`X-RateLimit-Remaining`	Requests remaining in the active window
`X-RateLimit-Reset`	ISO 8601 timestamp when the window resets

Handling 429

When a limit is exceeded, the server responds with HTTP 429 Too Many Requests.

Response body (RFC 7807)

{
  "type": "https://httpstatuses.com/429",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Rate limit exceeded.",
  "requestId": "abc-123"
}

Additional headers on 429

Header	Description
`Retry-After`	Seconds until the current window resets. Wait at least this long before retrying.
`X-RateLimit-Limit`	The limit that was exceeded (60 for minute, 5000 for day)
`X-RateLimit-Remaining`	`0` — no requests left in the current window

Best Practices

Check X-RateLimit-Remaining proactively and slow down before hitting 0.
On 429, read Retry-After and wait that many seconds before retrying.
Use exponential backoff with jitter if retrying in a loop.
The per-minute window resets at the top of each minute (UTC). The per-day window resets at UTC midnight.

If your use case requires higher limits, contact support@demoboost.com.