Skip to main content

Overview

CryptoMate enforces rate limits on all API endpoints to ensure fair access across integrations. Two independent limits apply to every request:
  • Per IP — based on the originating client IP address, always applied.
  • Per company — based on the company resolved from your x-api-key header, applied whenever a valid API key is present.
Both limits must be satisfied for a request to proceed. Exceeding either one triggers a penalty block with exponential backoff.

Limits

Limits are tracked independently — a single request counts against both your IP quota and your company quota at the same time.

Exponential backoff penalty

When a limit is exceeded, the API applies a progressive penalty block that grows exponentially with each successive violation: While a block is active, all requests from that IP or company are rejected immediately — no quota is consumed. The violation count resets automatically after 1 hour of clean traffic.

429 response

When rate limited, the API returns HTTP 429 with a Retry-After header indicating how many seconds to wait:

Retry strategy

Always read the Retry-After header and wait that exact duration before retrying:
If you are running batch operations, add a small pause between requests or process items in groups of 10–12 to stay safely under the 15 req/s ceiling and avoid accumulating violations.

Excluded paths

The following paths are exempt from rate limiting: