Rate limits
Responses include X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset.
| Group | Limit | Window |
|---|---|---|
| POST /auth/token | 10 | 1 minute per client |
| POST /v1/accounts/open | 100 | 1 minute per partner |
| POST /v1/kyc/submit | 50 | 1 minute per partner |
| POST /v1/payments/fund | 200 | 1 minute per partner |
| POST /v1/payments/cashout | 200 | 1 minute per partner |
| GET /v1/credit/simulate | 60 | 1 minute per client IP |
| POST /v1/credit/apply | 30 | 1 minute per partner |
| All other endpoints | 300 | 1 minute per partner |
Sandbox returns 429 when the window is full. The body is RATE_LIMITED. No live key is minted.
A business cap is a different error: PARTNER_LIMIT_EXCEEDED. Read it on usage.