# Rate limits

> Fixed windows per key, shared by every API server, with Retry-After on every 429.

Source: https://shopfa.st/docs/guides/rate-limits

| What | Limit | Window |
| --- | --- | --- |
| Requests per API key | 600 | 1 minute |
| Requests per OAuth connection | 600 | 1 minute |
| OAuth token endpoint, per IP | 60 | 1 minute |
| Checkouts per IP | 30 | 1 minute |
| Checkouts per buyer email | 30 | 1 hour |
| Plugin test runs per store | 120 | 1 minute |
| Callbacks per payment plugin | 300 | 1 minute |

Limits are counted in Postgres, so every API server shares one window: spreading requests across servers does not
reset them.

A limited request answers:

```http
HTTP/1.1 429 Too Many Requests
Retry-After: 17
Content-Type: application/problem+json

{"type":"https://shopfa.st/problems/rate-limited","title":"Too many requests","status":429,"detail":"This API key sent too many requests. Slow down and retry after the delay.","fields":[]}
```

Wait `Retry-After` seconds, then retry. For bulk work, pace yourself at about 8 requests per second per key and page
with `limit=100`. Limited requests appear in the key's request log with status 429.