Rate limits
Request limits per endpoint and what happens when you hit one.
Limits are per-IP address, not per-tenant or per-API-key — they're a spam/abuse safeguard, not a billing-plan feature.
Limits
| Endpoint(s) | Limit |
|---|---|
| Everything not listed below | 100 requests / minute |
POST /auth/signup | 10 / minute |
POST /auth/login | 10 / minute |
POST /auth/forgot-password | 5 / minute |
POST /auth/reset-password | 10 / minute |
POST /auth/accept-invite | 10 / minute |
POST /public/forms/:id/submit | 20 / minute |
POST /public/lists/:id/subscribe | 20 / minute |
These are the limits as currently configured in the API. They're intentionally tight on the auth endpoints (brute-force / credential-stuffing / signup-spam surface) and on the two public, unauthenticated endpoints (form submission, newsletter signup — spam surface). If you're building an integration that legitimately needs to submit a form or add subscribers faster than 20/minute from a single IP, batch through an authenticated endpoint instead (e.g. create a contact and add it to a list directly) rather than the public form/subscribe endpoints.
Exceeding a limit
You get back 429 Too Many Requests:
{
"statusCode": 429,
"message": "ThrottlerException: Too Many Requests"
}The window is a fixed 60-second bucket, not a sliding one — back off and retry after a few seconds rather than retrying immediately in a loop.
Last updated on