Rate Limits

The TokenBot REST API rate-limits requests to ensure fair usage and platform stability.

Default Limits

Limits are applied per minute, keyed by API key when authenticated, or by IP otherwise:

Caller	Limit
Authenticated (valid API key)	100 requests / minute
Unauthenticated	20 requests / minute per IP

Health-check endpoints (/health, /v1/health) are excluded from rate limiting.

Rate Limit Headers

Every response includes standard rate-limit headers:

x-ratelimit-limit: 100
x-ratelimit-remaining: 84
x-ratelimit-reset: 42

Rate Limit Exceeded

When you exceed the limit you get HTTP 429:

{
  "statusCode": 429,
  "code": "RATE_LIMITED",
  "message": "Rate limit exceeded. Please slow down.",
  "details": { "limit": 100, "remaining": 0, "resetMs": 42000 }
}

Best Practices

1. Authenticate — even read traffic gets a much higher limit with a valid key.
2. Use webhooks for real-time updates instead of polling.
3. Cache responses when possible.
4. Implement exponential backoff for retries.

Increasing Your Limits

Contact us at support@tokenbot.com to discuss higher rate limits.