# Rate limits

> Per-key limits, the headers that report them, and how to back off.

Source: https://docs.borga.is/api/rate-limits

Requests are limited per API key and mode in fixed one-minute windows.

| Caller | Limit |
| --- | --- |
| API key (`sk_…` or `pk_…`) | 1000 requests per minute per key |
| Public checkout endpoints (no key) | 60 requests per minute per IP address |

Buckets are per route, so a burst of session creations does not starve your payment lookups.

## Headers

Every rate-limited response carries the current state:

```http
RateLimit-Limit: 1000
RateLimit-Remaining: 993
RateLimit-Reset: 41
```

`RateLimit-Reset` is seconds until the window resets. When you exceed the limit the API returns `429` with [`rate_limit_exceeded`](/errors/rate_limit_exceeded) and a `Retry-After` header in seconds.

## Backing off

Wait at least `Retry-After` seconds, then retry with the same `Idempotency-Key` so the request cannot be duplicated. The Node SDK does this automatically, up to three times with exponential backoff. If you need sustained throughput above the limit, batch where the API allows it (usage events accept 1000 per request) and contact Borga.

## Webhooks and health checks

Webhook deliveries to your endpoint are not rate limited by Borga; your endpoint sets the pace by how fast it responds. Retries follow the schedule in [Webhooks](/webhooks).