Rate limits

Know every limit the API, the inbound endpoints and the webhooks apply, and what happens at each.

Updated 23 September 2026

On this page

Why: A limit you know about is a retry you can plan; one you discover is an outage.
What: Token bucket limits per key and per endpoint, plus caps on page sizes and batch sizes.
How: Read the tables, back off on 429 and page with cursor rather than asking for everything at once.

Request rates

Surface	Limit	Over it
REST API, `/api/v1`	600 requests a minute per key. The whole minute's allowance may arrive as one burst; it refills evenly.	429 `Rate limited`
Inbound endpoint, `/api/in/`	Bursts of up to 120 posts per endpoint, refilling at two a second	429 `Rate limited`

The REST limit is counted per key, so two integrations on two keys never slow each other. Every call counts, whichever route it hits.

Call	Most
`POST /api/v1/products/bulk`	10,000 products (413 above it)
`POST /api/v1/customers`	500 customers
`POST /api/v1/requests`	100,000 characters of text
Inbound endpoint	A 1MB body (413 above it); 500 customers or 1,000 products per post

Each delivery waits 10 seconds for your answer. A failed delivery is tried again in the nightly run, up to five attempts in all.

On 429 or 5xx, wait and retry with a growing pause.
Never retry a 4xx unchanged: it fails the same way.
Products upsert by SKU and customers by external id or email domain, so a retried batch updates rather than duplicates. Give every customer an external_id to be sure.