Each secret key can make 100 requests per 10 seconds. Requests without a valid key share a limit per IP address. Every response tells you where you stand:

Over the limit

You get 429 with this error:
Wait until X-RateLimit-Reset, then retry with the same Idempotency-Key. The libraries do this for you with backoff.

Staying under it

  • Use webhooks instead of polling for changes.
  • Fetch lists with limit=100 rather than many small pages.
  • Give each system its own key: limits are per key.
  • Spread batch jobs out instead of sending them all at once.
Need more for a launch or a migration? Email developers@ketapay.com with your expected volume.