Rate limits
Every verified request is charged against two buckets. Exceeding either returns
429 RATE_LIMITED, and the more constrained bucket drives the response headers.
| Bucket | Default | Scope |
|---|---|---|
| Per app | 600 req/min | One app, all endpoints and methods. Reads and writes share the budget |
| Per developer account | 1,800 req/min | All apps under your account combined. Registering more apps does not multiply your throughput |
| Sandbox sub-limit | 60 req/min | /open/v1/sandbox/* only, on top of the above |
| Pre-authentication | per source IP | Applies before your credentials are verified; apps sharing an egress IP share it |
Payload and batch sizing
Request bodies are capped at 1 MB. Larger requests return 413 PAYLOAD_TOO_LARGE with the message Request body exceeds 1048576 bytes.
| Workload | Recommended batch |
|---|---|
| Product bulk create | 50 products per request |
| Bulk order actions | 50 orders per request |
| Inventory bulk update | 100 items per request |
| Variant price or stock update | 50 variant updates per request |
Response headers
| Header | Meaning |
|---|---|
| X-RateLimit-Limit | Ceiling of the most constrained bucket. This is the authoritative live value — read it rather than hardcoding 600 |
| X-RateLimit-Remaining | Requests left in the current window |
| X-RateLimit-Reset | When the window resets |
| Retry-After | Seconds to wait. Sent on 429 |
Backoff
On 429, wait Retry-After then retry with exponential backoff and jitter. Do not retry
immediately in a tight loop — that is what the pre-auth IP limiter is there to stop, and it will affect every app behind
your egress address. Enterprise apps can be granted a higher ceiling; the header always reflects what you actually have.
Authentication flow limits
The seller consent flow has its own limiter, separate from the buckets above: POST /open/v1/auth/seller-verify allows 10 attempts per IP and 5 per seller identifier within a rolling 15-minute window (every attempt counts, successful or not). Exceeding either returns 429 RATE_LIMITED with a Retry-After header naming the seconds until the window reopens. Denied attempts do not extend the window. The OTP step has a separate wrong-code lockout that is not time-disclosed by design.