Overview
CryptoMate enforces rate limits on all API endpoints to ensure fair access across integrations. Two independent limits apply to every request:- Per IP — based on the originating client IP address, always applied.
- Per company — based on the company resolved from your
x-api-keyheader, applied whenever a valid API key is present.
Limits
Limits are tracked independently — a single request counts against both your IP quota and your company quota at the same time.
Exponential backoff penalty
When a limit is exceeded, the API applies a progressive penalty block that grows exponentially with each successive violation:
While a block is active, all requests from that IP or company are rejected immediately — no quota is consumed. The violation count resets automatically after 1 hour of clean traffic.
429 response
When rate limited, the API returns HTTP429 with a Retry-After header indicating how many seconds to wait:
Retry strategy
Always read theRetry-After header and wait that exact duration before retrying:

