Skip to main content
To ensure fair use and platform stability for all merchants, the Merchant API enforces rate and concurrency limits per API user. Exceeding these limits will result in specific HTTP-level error responses with headers to help you manage your request flow.

​
Limits

The rate limiter uses a token bucket algorithm keyed by API user ID. This means limits are enforced per API credential, not per IP address. Each API user has an independent token bucket, so if you need to separate concerns (e.g., rating vs. order submission), consider using separate API keys to avoid one workflow’s burst activity affecting another.
Each merchant is limited to 6 active API users. Attempting to create or activate additional API keys beyond this limit will result in an error: “You’ve reached your limit of 6 API keys. Please delete any unused API keys and try again.”

​
Response Codes

​
Response Headers

These headers are included on every response, including rate-limited responses, to help you track your current usage.

​
Rate Limit Headers

​
Concurrency Headers

​
Handling Rate Limit Errors

When you receive a 429 Too Many Requests response, inspect the Retry-After header and wait at least that many seconds before retrying the request. When you receive a 409 Conflict response, reduce the number of in-flight requests. Use the X-Concurrency-Current and X-Concurrency-Limit headers to gauge how close you are to the limit.
If your integration processes high volumes of requests (e.g., bulk order imports or rating calls), consider using separate API keys for different workflows. Since limits are tracked per API user, this prevents spikes in one workflow from affecting another.