SignalDeck
Start free

Docs

Rate limits

Every public API route draws from one of seven rate-limit buckets, counted in fixed 60-second windows per API key, per organization, or per IP address for anonymous callers. Each response says how much of the current window is left, and an exceeded bucket returns a structured 429.

Limits you can build against without surprises.#

  • Who is counted. Requests with an API key are counted per key within its organization. Signed-in requests without a key are counted per organization, and anonymous requests per IP address.
  • Seven buckets. Each route declares one bucket: auth, read, write, ai, billing, webhook, or admin. Buckets are counted separately, so heavy reads do not use up your write allowance.
  • Fixed 60-second windows. A bucket's window starts with the first request and resets 60 seconds later. There is no separate burst allowance.
  • Headers on every response. x-ratelimit-limit, x-ratelimit-remaining, and x-ratelimit-reset, where the reset is an ISO 8601 timestamp for the end of the current window.
  • Structured 429 responses. An exceeded bucket returns HTTP 429 with error rate_limit_exceeded and a message. Wait until x-ratelimit-reset before retrying.
  • Monthly plan limits are separate. Per-minute buckets protect the API. Monthly API call and webhook delivery allowances come from your plan and are listed on the pricing page.

Requests per 60-second window, by bucket.#

These values are the limiter's configuration in the API. Counters are held in memory by the API service.

  • auth. 30 requests per window.
  • read. 600 requests per window.
  • write. 120 requests per window.
  • ai. 30 requests per window.
  • billing. 60 requests per window.
  • webhook. 300 requests per window.
  • admin. 120 requests per window.

Social platforms have their own limits.#

Publishing is also limited by each provider, such as Instagram's rolling 24-hour publishing cap or YouTube's upload quota. Provider rate-limit and quota errors make the publish worker back off instead of retrying in a loop; they do not count against your API buckets.

Questions#

What's a sensible client backoff strategy?
On a 429, wait until the time in x-ratelimit-reset. For other retryable errors, use exponential backoff with jitter and cap the total number of retries.
Are AI calls counted separately?
Yes. AI routes use the ai bucket, 30 requests per window, separately from read and write.
Is there a Retry-After header?
No. Use x-ratelimit-reset, which is sent on every response, including the 429.
Do API keys and signed-in users share a counter?
No. Each API key has its own counters. Signed-in requests without a key share the organization's counters.
Start freeSecurity and data handling