Rate limits

Limits apply per API key, counted per minute, across both API versions.

Traffic	Limit	Response when exceeded
Requests with a valid key	300 per minute per key by default; a higher budget can be set on a key by support	429 `rate_limited` with a `Retry-After` header (seconds)
Requests with no key, an unknown key or a wrong secret	a shared ceiling for the whole service	429, or 401 before any work is done

A key over its budget receives 429 rate_limited with a Retry-After header. Only requests whose key verifies count against that key's budget: someone who learns your public key id cannot exhaust your budget with bad secrets. Public documentation endpoints are never throttled.

Good behavior

Honor Retry-After and back off; do not retry a 429 in a tight loop.
Prefer updated_since, since_id and webhooks to polling whole collections.
Spread scheduled syncs over the hour rather than firing them at :00.