API Rate Limits

To keep the service stable for everyone, the SaaS Custom Domains API enforces rate limits. This page explains the limits and how a rate-limited response looks.

Understanding Rate Limits

The SaaS Custom Domains API allows up to 360 requests per minute per API token. This rate limit is designed to prevent abuse and ensure equitable access to our services for all users. If you require a higher rate limit, reach out to our support team.

The Verify DNS records endpoint has its own limit of 5 requests per minute per API token. We re-check DNS records automatically after a custom domain is created, so polling this endpoint doesn't make verification any faster.

These limits apply to the API only, not to traffic on your custom domains. To limit traffic to your custom domains, use the rate limit handler in Rules.

Exceeding Rate Limits

If you exceed a rate limit, your additional requests will be rejected, and you will receive a 429: Too Many Requests status code. Along with this, the response body will include the following information:

{
  "error": "Rate Limit Exceeded",
  "error_code": "rate_limited"
}

Rate Limit Headers

When your request is rate limited, i.e. when you get the 429: Too Many Requests response, the response will also include additional headers that provide information about your current rate limit status:

• X-RateLimit-Limit: The maximum number of requests you can make per minute: 360, or 5 for the Verify DNS records endpoint.
• X-RateLimit-Remaining: The number of requests you can still make in the current minute window.
• X-RateLimit-Reset: The timestamp (in Unix epoch time) when the rate limit will reset.

Wait until the time in X-RateLimit-Reset before you send more requests.