Rate limits

REST and MCP request budgets

REST API and MCP requests each have a fixed 60-second window. The server allows up to 600 requests per client IP and 1,000 requests per API key in that window. The IP check runs before key lookup, so repeated invalid-key requests still consume the IP budget. REST and MCP keep separate counters. A single busy IP may reach 600 before any one key reaches 1,000.

Respond to HTTP 429

When either authentication budget is exhausted, the response is HTTP 429 with a JSON error and a Retry-After header containing seconds until the current window resets. Wait at least that long, then retry with a small amount of jitter. Do not run a tight retry loop. Successful responses do not currently include remaining-quota or reset headers.

if (response.status === 429) {
  const seconds = Number(response.headers.get("Retry-After") ?? 1);
  await sleep((Math.max(seconds, 1) + Math.random()) * 1000);
}

Stay within the budget

• Page through contacts or opportunities instead of sending many one-record lookups.
• Queue bursts and limit concurrency when several workers share an IP or key.
• Use webhooks for changes instead of polling the same list continuously.
• Be careful retrying writes: the REST API does not offer an idempotency-key contract for POST. Check whether the first request succeeded before creating another record.