---
title: "Rate limits"
description: "The request limits of the Lookio API per credential and per address, the headers that report them and how to back off when you reach one."
canonical: "https://lookio.app/docs/developers/rate-limits"
updated: "2026-11-08"
---

# Rate limits

Lookio limits requests to protect the service. The limits are the same for the REST API and the MCP server.

## Limits

| Limit                 | Value                      | Applies to                              |
| --------------------- | -------------------------- | --------------------------------------- |
| Sustained             | 240 requests per minute    | Each credential                         |
| Burst                 | 40 requests per 10 seconds | Each credential                         |
| Address ceiling       | 1,200 requests per minute  | Each IP address, across all credentials |
| Failed authentication | 30 failures per minute     | Each IP address                         |

The credential limits apply to normal use. The address ceiling stops traffic without credentials. It is far above the credential limits, so several credentials on one network do not reach it. The failed-authentication limit stops key guessing. A client with a valid credential never meets it.

Each workspace has its own limits.

## Accesses

An [access](/docs/developers/accesses) has its own limits, not the ones above, because its callers are outside your workspace.

| Limit        | Value                   | Applies to                                             |
| ------------ | ----------------------- | ------------------------------------------------------ |
| Per caller   | 60 requests per minute  | Each access key, or each IP address on a public access |
| Whole access | 600 requests per minute | All callers of one access together                     |
| Failed keys  | 30 failures per minute  | Each IP address, as above                              |

Its responses send `RateLimit-Policy: 60;w=60`. The credit ceilings of an access and its keys are separate. At a ceiling, the call fails with `rate_limited` and a message that names the ceiling.

## Widgets

A [widget](/docs/guides/widget/overview) is public, so it has the strictest limits. They count questions, not requests.

| Limit                          | Value                                  | Who sets it                                     |
| ------------------------------ | -------------------------------------- | ----------------------------------------------- |
| Questions per IP address       | 20 per minute, on one widget           | Fixed                                           |
| Chat openings per IP address   | 30 per minute, on one widget           | Fixed                                           |
| Answers, all visitors together | 60 per minute by default, 10 to 1,000  | You, per widget (`limits.questions_per_minute`) |
| Questions per visitor          | 40 per hour and 150 per day by default | You, per widget                                 |

The fixed limits stop one machine from flooding a widget. Your limits, and the monthly credit ceiling, set how much the widget can spend. See [Access and limits](/docs/guides/widget/access-and-limits#limits).

## When you hit a limit

The API returns `429`, the code `rate_limited`, and a `Retry-After` header in seconds: 10 after the burst limit, 60 after the others.

```http
HTTP/1.1 429 Too Many Requests
Retry-After: 10
```

Wait for `Retry-After`, then retry. If many workers share a credential, add random jitter so they do not retry together. The CLI does this for you.

## Headers

Every JSON response has the policy:

```http
RateLimit-Policy: 240;w=60, 40;w=10
```

It lists the limits and their windows in seconds. Lookio does not give a remaining count, because its limiter cannot calculate an exact one. Count your own requests against the policy.

## Notes

- Each Cloudflare location counts on its own, so the counts are approximate. A client on several continents can go a little over the limit. Your balance controls credit spending separately, so a burst cannot spend more credits than you have.
- In [Code Mode](/docs/developers/mcp/code-mode), each `request()` in a script counts against the credential's limit. A script makes at most 100 requests.
- OAuth client registration: 5 per minute per address.
- Imports are limited by these limits and by your plan's [word allowance](/docs/guides/resources#word-allowance) and [pages read each month](/docs/guides/resources#pages-read-each-month).