# Rate limits

The API limits how many requests a credential sends. A request over the limit
gets 429 `throttled`, with a `Retry-After` header: the number of seconds to
wait.

| Caller                         | Limit                                  |
| ------------------------------ | -------------------------------------- |
| An API key                     | 300 requests a minute, for each key    |
| An OAuth token (an MCP client) | 300 requests a minute, for each token  |
| A person in the browser        | 600 requests a minute                  |
| No credential                  | 60 requests a minute, for each address |

## Expensive operations

Some operations do more work, and have a second limit of **20 requests a
minute** on top of the first:

- The reports: trial balance, general ledger, open items, balance sheet,
  profit and loss, and the VAT preview. Each returns the whole answer and is
  cached until the books change, so asking again for the same report is
  cheap for you but still counts.
- The file upload.

## What to do

- On 429, wait for the seconds in `Retry-After`, then retry. Retry a write
  with the same `Idempotency-Key` (see [Idempotency](/docs/api/guides/idempotency)).
- Read a list with a large `limit` (up to 200) instead of many small pages.
- Keep a report you read often, and ask again when you need newer figures.

The limits can change. Read `Retry-After`, and do not hard-code the numbers.