Getting Started

Rate Limits

Every endpoint is rate-limited by group. Limits are tuned to what the endpoint does — brute-force-sensitive endpoints like login are much tighter than general reads.

Group	Limit	Applies to
`auth-strict`	5 / minute per IP	Login, register, password reset
`otp`	3 / minute, 10 / hour	Phone OTP send & confirm
`pin`	5 / minute per user	PIN verify & update
`financial`	15 / minute, 100 / hour	Wallet ops, bill purchases, biller/school/payment-link checkout
`api-authenticated`	60 / minute per user	General authenticated reads & writes
`api-public`	100 / minute per IP	Public listings & lookups (schools, billers, banks)

When you exceed a limit

You'll get a 429 Too Many Requests response. The Retry-After header tells you how many seconds to wait before your next request will succeed.

bash

HTTP/1.1 429 Too Many Requests
Retry-After: 42
X-RateLimit-Limit: 15
X-RateLimit-Remaining: 0

Building a client

Back off using Retry-After rather than a fixed delay — limits vary significantly by endpoint group, and a login retry loop should behave very differently from a balance-polling loop.

← Previous

Errors & Status Codes

Overview