---
title: "Rate limits"
description: "The request limits of the Lookio API per credential and per address, the headers that report them and how to back off when you reach one."
canonical: "https://lookio.app/docs/api/rate-limits"
updated: "2026-10-17"
---

# Rate limits

Lookio limits requests to protect the service. The limits apply to the REST API and to the MCP server alike.

## Limits

| Limit                 | Value                      | Applies to                              |
| --------------------- | -------------------------- | --------------------------------------- |
| Sustained             | 240 requests per minute    | Each credential                         |
| Burst                 | 40 requests per 10 seconds | Each credential                         |
| Address ceiling       | 1,200 requests per minute  | Each IP address, across all credentials |
| Failed authentication | 30 failures per minute     | Each IP address                         |

The credential limits shape normal use. The address ceiling exists so that unauthenticated traffic cannot overload the service, and it is far above the credential limit so that several credentials behind one network address never reach it. The failed-authentication limit stops key guessing, and a client with a working credential never touches it.

Two workspaces never share a budget.

## When you hit a limit

The API answers `429` with the `rate_limited` code and a `Retry-After` header in seconds: 10 after the burst limit, 60 after the others.

```http
HTTP/1.1 429 Too Many Requests
Retry-After: 10
```

Wait for `Retry-After`, then retry. Add random jitter if many workers share a credential, so they do not retry together. The CLI does this for you.

## Headers

Every JSON response carries the policy:

```http
RateLimit-Policy: 240;w=60, 40;w=10
```

It lists the limits and their windows in seconds. Lookio does not report a remaining count: its limiter cannot compute one, and a number it could not stand behind would mislead your throttle. Count your own requests against the policy.

## Notes

- Counters are kept per Cloudflare location and are approximate. A client spread across continents can exceed the nominal rate somewhat. The limiter is not an accounting system: credit spending is enforced separately, by the balance, so a burst cannot overspend your credits.
- In [Code Mode](/docs/mcp/code-mode), each `request()` made inside a script counts against the credential's limit, and a script can make at most 100 of them.
- Registering an OAuth client is limited to 5 per minute per address.
- Importing is not throttled by credits, but by these limits and by your plan's [word allowance](/docs/platform/resources#word-allowance).