Rate Limits

Current Limits

The default rate limit is 60 requests per minute per API key.

When creating an API key, you can configure a custom rate limit (minimum 1, maximum 10,000 requests per minute).

Limits apply per API key. Multiple keys have independent rate limit windows.

How Rate Limits Work

Passkallet uses a sliding window rate limiter. When your API key exceeds the limit, you receive a 429 Too Many Requests response:

{
  "statusCode": 429,
  "content": {
    "message": "Rate limit exceeded. Try again in 45 seconds."
  }
}

The error message tells you how many seconds until the rate limit window resets.

How to Handle Rate Limits

async function fetchWithBackoff(url, options, maxRetries = 5) {
  for (let attempt = 0; attempt < maxRetries; attempt++) {
    const response = await fetch(url, options);

    if (response.status === 429) {
      const data = await response.json();
      // Parse the retry time from the error message, or use exponential backoff
      const waitTime = Math.min(1000 * Math.pow(2, attempt), 30000);

      console.log(`Rate limited (attempt ${attempt + 1}). Waiting ${waitTime}ms...`);
      await new Promise((resolve) => setTimeout(resolve, waitTime));
      continue;
    }

    return response;
  }

  throw new Error("Max retries exceeded");
}

Tips for Staying Under the Limit

1. Cache responses. Same data multiple times? Cache it.
2. Use webhooks instead of polling. Get notified when status changes.
3. Spread requests over time. Avoid bursting all requests at once.
4. Use different keys for different services. Each key has independent limits.
5. Configure higher limits. When creating an API key, set a higher rate limit if needed (up to 10,000/min).