---
title: Public API rate limits
description: The Public API now rejects abusive request bursts with HTTP 429 and Retry-After.
type: changelog
date: 2026-08-29
changelog:
  category: Improved
---

The Public API now enforces a shared request ceiling so one address or one token cannot flood the service. Each client IP may send 3000 requests per minute. Each access token or signed-in session may send 1200 requests per minute.

When a caller exceeds the ceiling, the API returns HTTP 429. The response includes `Retry-After` and `X-RateLimit-Limit` / `X-RateLimit-Remaining` so clients can wait and retry. Normal interactive use and typical integrations stay well below these limits.