Limits
| Limit | Value |
|---|---|
| Per key, per minute | 60 requests |
| Per key, per day | 5,000 requests |
| Calls that issue, per key | 30 a minute, on top of the above |
| PDF and XML downloads, per key | 10 a minute and 1,000 a day, on top of the above |
| All keys of one company together | Enterprise: 240 a minute and 50,000 a day. Business: 60 a minute and 5,000 a day. Sandbox company: 30 a minute and 2,000 a day. |
| Failed authentication, per IP address | 100 failed attempts a minute. Beyond that, calls from the address are refused for the rest of the minute; a key that recently worked from that address keeps working. |
Limits count per key, and every key of a company also shares the company's budget, so more keys never buy more calls. A refused call answers 429 rate_limited with a Retry-After header in seconds, and X-RateLimit-* headers:
HTTP/1.1 429 Too Many Requests
Retry-After: 17
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 0
{"ok":false,"error":{"code":"rate_limited","message":"Too many requests. Wait for the time given in the Retry-After header, then try again."}}Retrying well
- On
429, waitRetry-Afterseconds, then retry. - On a network error or a
5xx, retry with exponential backoff (for example 1, 2, 4 and 8 seconds) and the sameexternal_reference. - Do not retry other
4xxresponses; fix the request. - Spread bulk work over time instead of sending it in a burst, and create invoices from a background job.
An app connected through OAuth also shares one budget of 600 requests a minute across every company it acts for.
Related
Ready to build?
API access is part of the Business and Enterprise plans. Create a key in Settings → API keys and make your first call in minutes.