> ## Documentation Index
> Fetch the complete documentation index at: https://developers.firstbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate limits

> Per-key quotas, response headers, 429 body, and recommended client backoff.

The Public API limits each API key independently. One key is one bucket. Limits apply to `/api/*` and `/scim/v2/*`.

| Window      | Limit                                 |
| ----------- | ------------------------------------- |
| Sustained   | 600 requests / 60 seconds             |
| Burst       | 150 requests / 10 seconds             |
| Concurrency | 10 in-flight requests per key per pod |

## Response headers

Every authenticated response includes both header families, including 429s.

| Header                  | Meaning                                                        |
| ----------------------- | -------------------------------------------------------------- |
| `X-RateLimit-Limit`     | Max requests in the tighter of the sustained and burst windows |
| `X-RateLimit-Remaining` | Requests left in that same window                              |
| `X-RateLimit-Reset`     | Unix epoch seconds when that window resets                     |
| `RateLimit-Limit`       | Same as `X-RateLimit-Limit`                                    |
| `RateLimit-Remaining`   | Same as `X-RateLimit-Remaining`                                |
| `RateLimit-Reset`       | Seconds until that window resets (delta, not epoch)            |

`X-RateLimit-Reset` is epoch seconds. `RateLimit-Reset` is a delta in seconds. Do not treat them as interchangeable. A burst 429 shows remaining `0` and `RateLimit-Reset` equal to the burst TTL, matching `Retry-After`.

## When you are limited

A rejected request returns **429** with `Retry-After` (seconds) and:

```json theme={null}
{"errors":[{"detail":"...","source":"publicapi"}]}
```

## Recommended backoff

1. Honour `Retry-After`. Wait that many seconds before retrying.
2. When `RateLimit-Remaining` is `0`, wait `RateLimit-Reset` seconds before sending more traffic.
3. Cap retries. Treat a sequence of 429s as a signal to slow the whole client, not just the one request.

<Warning>
  Clients that ignore `Retry-After` will keep receiving 429s until the window rolls over.
</Warning>