Rate limits
Requests per minute per plan, per key, and the headers that tell you where you stand.
Every Workspace has a number of requests per minute shared by all its keys, and each key can have a lower limit of its own. Test traffic in sandboxes has its own pool.
| Plan | Requests per minute | API keys | Webhook endpoints | Sandboxes |
|---|---|---|---|---|
| Creator | 60 | 3 | 3 | 1 |
| Pro | 120 | 10 | 10 | 2 |
| Business | 300 | 25 | 16 | 5 |
| Agency | 600 | 100 | 32 | 5 |
| Enterprise | By contract | By contract | By contract | By contract |
Free does not include the API.
Most requests count once. Requests that do more work count five times: duplicating a post, and AI tools when they arrive.
Headers
Every response says where you stand:
RateLimit-Policy: "workspace";q=300;w=60, "key";q=300;w=60
RateLimit: "key";r=287;t=41q is the quota per window of w seconds, r what remains and t the seconds until the window resets. RateLimit reports whichever of the two limits is closer.
When you go over, the API answers 429 rate_limited with Retry-After in seconds. Wait that long, then retry.
Keys that are not valid
An address that sends more than 20 requests in a minute with keys that are not valid (unknown, revoked, expired or mistyped) gets 429 rate_limited for the rest of that minute, whatever key it sends. If you see this, check that your integration uses a current key: a revoked or rolled key keeps failing until you replace it.
Plan limits
Rate limits are separate from what your plan allows: how many posts you can publish, how much storage you have, how many accounts you can connect. The API uses exactly the same limits as the app, so a post the app would refuse is refused here too, with the same code.