Rate limits
Credits bound what you spend. These bound how fast you can spend it, and they are separate on purpose: a funded account with a runaway loop is still a runaway loop.
| Limit | What it bounds | On breach |
|---|---|---|
| Requests per second | How fast requests arrive | 429 rate_limited |
| Concurrent requests | How many run at once | 429 too_many_concurrent |
| Credits per minute | Spend rate, regardless of balance | 429 cost_ceiling |
| Heavy routes | Their concurrency, shared across all keys | 429 busy_route |
Why concurrency is the one that matters
Requests per second bounds arrival. Concurrency bounds simultaneous work. Ten requests a second that each finish in 20 ms is nothing; a handful that each hold an expensive query open for seconds is not. If you tune one number, tune this one.
Heavy routes
A few routes cost far more to serve than the rest. The cost table marks them and
their price says so, and their concurrency is shared across all keys — so a
429 busy_route can mean someone else is mid-flight rather than that you did
anything wrong. Honour the Retry-After and it clears.
Load shedding
Under pressure, a metered request may be refused with 503 server_busy and
Retry-After: 2. It is charged nothing.
If you keep hitting a limit
Twenty refusals in a minute auto-suspends the key for fifteen minutes.
We suspend the key, not your address. A firewall ban would take out everyone behind your egress, and a browser challenge is not something an API client can solve — so a paying customer who misconfigures a loop gets a pause, not an outage.