300 requests a minute per person or API key, with tighter limits on sign-in and one-time codes.
| Who is counted | Limit |
|---|---|
| Each signed-in person, or each API key | 300 requests a minute |
| Requests without a token, per IP address | 10 a second |
| Sign-in attempts, per IP address | 20 a minute |
| Sign-in attempts, per email address | 10 every 15 minutes |
| One-time codes, per IP address | 8 every 15 minutes |
| One-time codes, per email address | 5 every 15 minutes |
Over a limit the API answers 429 with code RATE_LIMITED and a Retry-After header in seconds. Wait that long and try again.
Building a sync? Page through lists with per_page up to the maximum rather than calling one record at a time, and spread a nightly job over a few minutes.