---
title: "Rate limits"
description: "The Pallyy API allows 5 requests per second per account. Read the rate limit headers on every response and back off on 429s."
category: "getting-started"
emoji: "⏱️"
order: 2
datePublished: "2026-08-20"
dateUpdated: "2026-08-20"
---

The Pallyy API allows **5 requests per second** per account, counted in fixed one-second windows. The limit is shared across all of the account's API keys.

## Rate limit headers

Every response includes headers describing your current window:

| Header | Meaning |
| --- | --- |
| `X-RateLimit-Limit` | Requests allowed per second (currently `5`) |
| `X-RateLimit-Remaining` | Requests left in the current window |
| `X-RateLimit-Reset` | Unix timestamp (in seconds) when the next window starts |

## Exceeding the limit

Once the window is used up, further requests receive a `429` response with a `Retry-After: 1` header and this error body:

```json
{
  "statusCode": 429,
  "statusMessage": "Rate limit exceeded",
  "data": {
    "code": "rate_limit_exceeded",
    "count": 5,
    "max": 5
  }
}
```

## Handling limits in your client

- Watch `X-RateLimit-Remaining` and slow down before you hit zero.
- On a `429`, wait for the duration in `Retry-After` (one second) and retry.
- Spread bulk work out instead of bursting. Windows are only a second long, so a short pause is always enough to recover.