Rate limits
The request limits of the Lookio API per credential and per address, the headers that report them and how to back off when you reach one.
Lookio limits requests to protect the service. The limits are the same for the REST API and the MCP server.
Limits
| Limit | Value | Applies to |
|---|---|---|
| Sustained | 240 requests per minute | Each credential |
| Burst | 40 requests per 10 seconds | Each credential |
| Address ceiling | 1,200 requests per minute | Each IP address, across all credentials |
| Failed authentication | 30 failures per minute | Each IP address |
The credential limits apply to normal use. The address ceiling stops traffic without credentials. It is far above the credential limits, so several credentials on one network do not reach it. The failed-authentication limit stops key guessing. A client with a valid credential never meets it.
Each workspace has its own limits.
Accesses
An access has its own limits, not the ones above, because its callers are outside your workspace.
| Limit | Value | Applies to |
|---|---|---|
| Per caller | 60 requests per minute | Each access key, or each IP address on a public access |
| Whole access | 600 requests per minute | All callers of one access together |
| Failed keys | 30 failures per minute | Each IP address, as above |
Its responses send RateLimit-Policy: 60;w=60. The credit ceilings of an access and its keys are separate. At a ceiling, the call fails with rate_limited and a message that names the ceiling.
Widgets
A widget is public, so it has the strictest limits. They count questions, not requests.
| Limit | Value | Who sets it |
|---|---|---|
| Questions per IP address | 20 per minute, on one widget | Fixed |
| Chat openings per IP address | 30 per minute, on one widget | Fixed |
| Answers, all visitors together | 60 per minute by default, 10 to 1,000 | You, per widget (limits.questions_per_minute) |
| Questions per visitor | 40 per hour and 150 per day by default | You, per widget |
The fixed limits stop one machine from flooding a widget. Your limits, and the monthly credit ceiling, set how much the widget can spend. See Access and limits.
When you hit a limit
The API returns 429, the code rate_limited, and a Retry-After header in seconds: 10 after the burst limit, 60 after the others.
HTTP/1.1 429 Too Many Requests
Retry-After: 10Wait for Retry-After, then retry. If many workers share a credential, add random jitter so they do not retry together. The CLI does this for you.
Headers
Every JSON response has the policy:
RateLimit-Policy: 240;w=60, 40;w=10It lists the limits and their windows in seconds. Lookio does not give a remaining count, because its limiter cannot calculate an exact one. Count your own requests against the policy.
Notes
- Each Cloudflare location counts on its own, so the counts are approximate. A client on several continents can go a little over the limit. Your balance controls credit spending separately, so a burst cannot spend more credits than you have.
- In Code Mode, each
request()in a script counts against the credential’s limit. A script makes at most 100 requests. - OAuth client registration: 5 per minute per address.
- Imports are limited by these limits and by your plan’s word allowance and pages read each month.