Guides · Reference

Rate limits & usage

Bucket	Limit	Applies to
per API key	600 requests / minute	every authenticated request with that key
per business	1,200 requests / minute	all keys of the business together
per IP, unauthenticated	300 requests / minute	public routes, `/auth/*` (10/min), requests without credentials
holds	60 / minute per business	`POST /businesses/:id/holds`

Every authenticated response carries the tightest applicable bucket:

RateLimit-Limit: 600
RateLimit-Remaining: 597
RateLimit-Reset: 42

Past the limit the api answers 429 RATE_LIMITED with Retry-After (seconds) and the error envelope:

{ "error": { "code": "RATE_LIMITED", "message": "Too many requests. Retry in 42 s.", "requestId": "req_…" } }

Back off until Retry-After and retry; idempotent writes (see Idempotency) are safe to repeat. Windows are fixed 60-second windows.

Usage — GET /businesses/:businessId/api-usage?from&to (OWNER session) returns requests and throttled requests per day per key for up to 92 days; the Chale Business app shows the same under Developers.