Rate limits

Use this guide when handling 429 responses or planning storefront traffic.

Default limits

Authenticated API keys are currently limited to 60 requests per minute per key. Most public browser routes are limited to 30 requests per minute by origin and IP.

Live GET /v1/embed/fills/{id}/preview requests have a dedicated budget of 120 requests per 60 seconds per short-lived embed-session secret. Debounce text changes before sending PATCH + preview; stable state is served from the content-addressed preview cache.

Headers

Every API response includes rate limit metadata when available.

X-RateLimit-Limit: 60
X-RateLimit-Remaining: 58
X-RateLimit-Reset: 1760000000

When a request is limited, the response includes Retry-After.

Common handling

Back off until Retry-After. Do not retry immediately in a loop from the browser widget.

See Errors.