Rate limits
Fixed windows per key, shared by every API server, with Retry-After on every 429.
| What | Limit | Window |
|---|---|---|
| Requests per API key | 600 | 1 minute |
| Requests per OAuth connection | 600 | 1 minute |
| OAuth token endpoint, per IP | 60 | 1 minute |
| Checkouts per IP | 30 | 1 minute |
| Checkouts per buyer email | 30 | 1 hour |
| Plugin test runs per store | 120 | 1 minute |
| Callbacks per payment plugin | 300 | 1 minute |
Limits are counted in Postgres, so every API server shares one window: spreading requests across servers does not reset them.
A limited request answers:
HTTP/1.1 429 Too Many Requests
Retry-After: 17
Content-Type: application/problem+json
{"type":"https://shopfa.st/problems/rate-limited","title":"Too many requests","status":429,"detail":"This API key sent too many requests. Slow down and retry after the delay.","fields":[]}Wait Retry-After seconds, then retry. For bulk work, pace yourself at about 8 requests per second per key and page
with limit=100. Limited requests appear in the key’s request log with status 429.