Rate limits
Per-key limits, the headers that report them, and how to back off.
Requests are limited per API key and mode in fixed one-minute windows.
| Caller | Limit |
|---|---|
API key (sk_… or pk_…) | 1000 requests per minute per key |
| Public checkout endpoints (no key) | 60 requests per minute per IP address |
Buckets are per route, so a burst of session creations does not starve your payment lookups.
Headers
Every rate-limited response carries the current state:
RateLimit-Limit: 1000
RateLimit-Remaining: 993
RateLimit-Reset: 41RateLimit-Reset is seconds until the window resets. When you exceed the limit the API returns 429 with rate_limit_exceeded and a Retry-After header in seconds.
Backing off
Wait at least Retry-After seconds, then retry with the same Idempotency-Key so the request cannot be duplicated. The Node SDK does this automatically, up to three times with exponential backoff. If you need sustained throughput above the limit, batch where the API allows it (usage events accept 1000 per request) and contact Borga.
Webhooks and health checks
Webhook deliveries to your endpoint are not rate limited by Borga; your endpoint sets the pace by how fast it responds. Retries follow the schedule in Webhooks.