Rate limits

Calls are counted per minute: per key, and per IP address at five times the limit of a key. Calls with a wrong key count against the IP address too. Issuing certificates in bulk has a lower limit of its own. The open resources under /public are counted per IP address.

Today the limits are 600 calls per minute per key, 3,000 per IP address, 30 per minute for issuing certificates in bulk, and 120 per minute per IP address under /public. They can change (see versioning); the headers always say the one that applies.

Responses carry X-RateLimit-Limit and X-RateLimit-Remaining. Over the limit, the answer is 429 rate_limited, with a Retry-After header in seconds.

Wait for Retry-After before trying again: repeating at once only keeps the block going. To read a lot, page with the largest limit and sync only what changed (see pagination).