Public API rate limits

The Public API now rejects abusive request bursts with HTTP 429 and Retry-After.

The Public API now enforces a shared request ceiling so one address or one token cannot flood the service. Each client IP may send 3000 requests per minute. Each access token or signed-in session may send 1200 requests per minute.

When a caller exceeds the ceiling, the API returns HTTP 429. The response includes Retry-After and X-RateLimit-Limit / X-RateLimit-Remaining so clients can wait and retry. Normal interactive use and typical integrations stay well below these limits.