Limits
The request rate limit, the number of keys, the request size and the caching rules.
Request rate
No more than 300 requests per 60 seconds from one sender address.
- The count is kept per IP address the request came from, not per key. Several of your servers behind one address share the limit.
- The read endpoints share one count: a request to any of them reduces the common remainder.
- Requests rejected because of the key count too.
The remainder is shown in the headers of every response:
| Header | What it holds |
|---|---|
RateLimit-Limit | The limit |
RateLimit-Remaining | How many requests are left until the end of the window |
RateLimit-Reset | In how many seconds the count starts over |
RateLimit-Policy | The limit and the window length in one line |
A request over the limit gets a 429 error. Wait as many seconds as RateLimit-Reset says: until the end of the window the response stays the same.
Keys
A merchant can have no more than 10 keys at a time. Details: Authentication.
Request size
A request body is accepted only as JSON and no larger than 256 KB. The endpoints released today have no body at all.
Caching
API responses must not be cached: each has the Cache-Control: no-store header. This applies to intermediate nodes on your side too: a stale copy of the service list would show the payer a payment method that no longer exists.