Skip to main content
Windows are fixed minutes. Every authenticated response carries the token budget:
When a limit is exceeded, the response is 429 RATE_LIMITED with a retry-after header and details.retry_after_seconds. Wait that many seconds before you retry.
Read x-ratelimit-remaining and slow down before it reaches zero. Retry 429 and 5xx responses with backoff; do not retry other 4xx responses without changing the request.
After 20 failed authentications from one IP address in a minute, every request from that address receives 429 until the window ends, even with a valid token. Check that your script sends the current token before it retries.