# Rate limits

> Understand Badge's per-IP and per-key API quotas and 429 responses.

The platform enforces per-IP limits: 300 requests/minute on reads, 60/minute on writes, and 10/minute on auth endpoints. Each API key additionally records a per-minute and per-day quota (defaults 60/min and 10,000/day). Set them when creating the key or adjust them later via `PATCH /api/v1/api-keys/:id`; there is no Settings UI for per-key overrides yet.

Every rate-limited response reports its per-IP quota through the draft-RFC headers `RateLimit-Limit`, `RateLimit-Remaining`, and `RateLimit-Reset` (seconds until the current minute window rolls over). Exceeding a limit returns `429` with a `Retry-After` header:

```text
HTTP/2 429
Retry-After: 42
RateLimit-Limit: 300
RateLimit-Remaining: 0
RateLimit-Reset: 42

{
  "error": "Too Many Requests",
  "message": "Rate limit exceeded. Max 300 requests per minute for read operations.",
  "retry_after_seconds": 42
}
```

If the limiter is temporarily degraded, requests pass through without quota headers. A missing `RateLimit-*` set means no quota was checked on that response, not that none applies.

Return to the [REST API reference](/docs/reference/rest-api) for authentication and endpoint examples.