Rate Limits
Every request counts towards two limits:
| Window | Limit |
|---|---|
| 500 milliseconds | 3 requests |
| 10 seconds | 60 requests |
Both are sliding windows, counted at the moment each request reaches our servers. The limits apply to your IP address and, for private requests, to your API key as well: public and private requests from the same IP address share the same limits, and all processes that use the same API key share them too.
When you exceed a limit you receive 429 Too Many Requests with a Retry-After header (seconds to wait):
{ "success": false, "message": "TOO_MANY_REQUESTS", "code": 8018 }
Network delays can make two requests sent 500 ms apart arrive closer together, so leave a margin: sending at most one request every 200 ms keeps you safely within both limits.
Invalid signatures
After 10 requests with an invalid signature or an unknown API key within one minute, requests from the same API key
or IP address are refused for 60 seconds with the same 429 response and a Retry-After header.
WebSocket limits
| Limit | Value |
|---|---|
| Connections per IP address | 20 |
| Subscriptions per connection | 50 |
| Messages you send per second, per connection | 10 |
Exceeding a limit closes the connection with close code 1008 and a reason that names the limit. Each subscribe or unsubscribe request counts as one message, so when you subscribe to many channels after connecting, send at most 10 requests per second.