Rate limits
Two separate limits apply, depending on which endpoint you're calling.
POST /v1/verify, per API key
60 requests/minute per API key by default, sliding window. If you have multiple keys, each has its own independent limit.
POST /v1/sessions/:token/complete, per IP
20 requests/minute per IP address by default. This is the endpoint the hosted verify page itself calls, it has no API key to rate-limit by, since it's the end user's own browser making the request.
Response headers
Every rate-limited response includes:
| Field | Type | Required | Description |
|---|---|---|---|
| X-RateLimit-Limit | integer | optional | The limit for the current window. |
| X-RateLimit-Remaining | integer | optional | Requests remaining in the current window. |
When you're rate limited
429 Too Many Requests
{
"success": false,
"message": "Rate limit exceeded.",
"retry_after_ms": 4213
}Hitting this consistently in normal usage, rather than during a burst or an integration bug, is a sign your plan's limits should be revisited, reach out rather than working around it.