Recipe

Handle rate limits gracefully

The public ring allows 60 requests per 60 seconds per IP. Cross it and you get a 429 with Retry-After. Avoid it with client-side throttling and caching; recover from it by honouring Retry-After and backing off with jitter.

2 min read

60 / 60 sPer IP
Retry-AfterHonour it
CacheAvoid the call

Avoid the limit

Cache responses that rarely change (product data, loyalty tiers), coalesce duplicate in-flight requests, and throttle client-side so you never burst past the window. See Rate limits and 429.

Recover from a 429

On a 429, read Retry-After (seconds) and wait at least that long before retrying. Add jitter so many clients do not retry in lockstep.

if (res.status === 429) {
  const wait = (Number(res.headers.get('Retry-After')) || 1) + Math.random();
  await sleep(wait * 1000);
  return retry();
}

Design for it

Rate limiting is defence-in-depth, not a reliability gate. Treat a 429 as a normal, expected signal to slow down — not an error to surface to users.

Frequently asked questions

Is the limit per key or per IP?

The public ring limits per IP. There is no API key on that ring — see the public /public/v1 ring.

What if there is no Retry-After header?

Fall back to exponential backoff with jitter. Retry-After is the precise signal; backoff is the safe default when it is absent.

Funding for UK limited companies

Credicorp lends to your company, not to you personally — short-term working capital with no personal guarantee. See what your business could access.