Rate limits - Firstbase API

The Public API limits each API key independently. One key is one bucket. Limits apply to /api/* and /scim/v2/*.

Window	Limit
Sustained	600 requests / 60 seconds
Burst	150 requests / 10 seconds
Concurrency	10 in-flight requests per key per pod

Response headers

Every authenticated response includes both header families, including 429s.

Header	Meaning
`X-RateLimit-Limit`	Max requests in the tighter of the sustained and burst windows
`X-RateLimit-Remaining`	Requests left in that same window
`X-RateLimit-Reset`	Unix epoch seconds when that window resets
`RateLimit-Limit`	Same as `X-RateLimit-Limit`
`RateLimit-Remaining`	Same as `X-RateLimit-Remaining`
`RateLimit-Reset`	Seconds until that window resets (delta, not epoch)

X-RateLimit-Reset is epoch seconds. RateLimit-Reset is a delta in seconds. Do not treat them as interchangeable. A burst 429 shows remaining 0 and RateLimit-Reset equal to the burst TTL, matching Retry-After.

When you are limited

A rejected request returns 429 with Retry-After (seconds) and:

{"errors":[{"detail":"...","source":"publicapi"}]}

Recommended backoff

Honour Retry-After. Wait that many seconds before retrying.
When RateLimit-Remaining is 0, wait RateLimit-Reset seconds before sending more traffic.
Cap retries. Treat a sequence of 429s as a signal to slow the whole client, not just the one request.

Clients that ignore Retry-After will keep receiving 429s until the window rolls over.