Rate limits

To protect the service, the API applies rate limits.

Limits

Limit	Default value	Counted per
General (all endpoints)	100 requests per minute	Authenticated User (JWT token); without a token, per IP.
Authentication (login, email verification, password recovery, 2FA…)	5 requests per minute	Same as the general one.
Per API Key	The one set when the key was created: between 1 and 10,000 requests per hour (1,000 by default)	Each API Key.

Note

The general values are configurable per environment; the ones in the table are the service’s defaults.

What happens if you exceed a limit

• General or authentication limit: you get 429 Too Many Requests (code RATE_LIMIT_EXCEEDED). Wait a few seconds and retry with exponential backoff.
• Hourly limit of an API Key: the request is rejected with 403 and the message “Rate limit excedido” until the hour is up. See API Keys.

Best practices

• Cache responses that don’t change often.
• Avoid aggressive polling; use pagination and date filters.
• For large loads, spread the requests over time.
• For integrations, use an API Key with a limit that matches your volume.