> ## Documentation Index
> Fetch the complete documentation index at: https://crevio.co/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Rate limits
> How Crevio throttles API requests — the per-credential limit, the RateLimit headers on every response, and how to back off cleanly on a 429.
**Every Crevio API request is rate limited, and every response tells you exactly where you stand.** Read the `RateLimit` headers to pace yourself, and back off on a `429` instead of hammering.
## The limit
Crevio allows **600 requests per 60-second window** per credential on the free tier, and **3,000** on a paid plan.
| Tier | Limit | Window |
| -------------------------------- | -------------- | ------------------ |
| `free` — no active subscription | 600 requests | 60 seconds (fixed) |
| `paid` — any active subscription | 3,000 requests | 60 seconds (fixed) |
Over the limit you get a `429` with code `rate_limit_exceeded`, a `Retry-After` header, and your `plan_tier` in the error body.
The window is **fixed**, not rolling: the counter resets to zero at the moment given by `X-RateLimit-Reset`, not 60 seconds after each individual request.
The limit is uniform across **all** `https://api.crevio.co/v1` endpoints — reads and writes draw from the same counter. There are no per-endpoint tiers.
## Reading your quota before you need it
The response headers tell you where you stand *after* a request. To know your ceiling up front — on startup, or to size a batch — call [`GET /v1/status`](/docs/developer/api-reference/status/get-status):
```json theme={null}
{
"limits": {
"rate_limit": {
"tier": "paid",
"limit": 3000,
"window_seconds": 60,
"remaining": 2984,
"resets_at": "2026-09-02T18:41:00Z"
},
"task_runs": { "max_concurrent_per_account": 5, "max_concurrent_per_task": 1, "max_runtime_seconds": 14400 },
"pagination": { "default_limit": 15, "max_limit": 100 }
}
}
```
Prefer these values over hard-coding the numbers in this page — they move with your plan.
## What counts as a credential
The counter is keyed to whoever is making the call, so one integration can never exhaust another's budget:
* **API token** — requests authenticated with `Authorization: Bearer YOUR_API_TOKEN` are counted per token. Issue separate tokens for separate workloads and they get separate budgets.
* **IP address** — OAuth-session and unauthenticated requests fall back to per-IP counting.
## Response headers
Every response — success or failure — carries your current standing. Read these instead of guessing.
Crevio sends two families of headers. Prefer the standard `RateLimit` pair; the
`X-RateLimit-*` triple is kept for existing integrations and will not be removed
without notice under our [deprecation policy](/docs/developer/guides/versioning).
### Standard (recommended)
These are the IETF [RateLimit header fields](https://datatracker.ietf.org/doc/html/draft-ietf-httpapi-ratelimit-headers), encoded as [structured fields](https://www.rfc-editor.org/rfc/rfc9651).
| Header | Meaning |
| ------------------ | -------------------------------------------------------------------------------------- |
| `RateLimit-Policy` | The quota policy: `q` is the allowance, `w` the window in seconds. Constant. |
| `RateLimit` | Your current standing: `r` is requests remaining, `t` seconds until the window resets. |
```http theme={null}
HTTP/1.1 200 OK
RateLimit-Policy: "default";q=600;w=60
RateLimit: "default";r=594;t=42
```
### Legacy
| Header | Meaning |
| ----------------------- | ----------------------------------------------------------------------------------------------- |
| `X-RateLimit-Limit` | Maximum requests allowed in the window (`600`). |
| `X-RateLimit-Remaining` | Requests left in the current window. |
| `X-RateLimit-Reset` | UTC epoch seconds (Unix timestamp) when the window resets and `Remaining` returns to the limit. |
```http theme={null}
X-RateLimit-Limit: 600
X-RateLimit-Remaining: 594
X-RateLimit-Reset: 1735689600
```
When the remaining count gets low, wait out the window rather than retrying into a wall: `RateLimit`'s `t` parameter is already the number of seconds to sleep.
## The 429 response
Exceed the limit and the request is rejected with HTTP `429` and the standard [error envelope](/docs/developer/guides/errors):
```json theme={null}
{
"error": {
"type": "invalid_request_error",
"code": "rate_limit_exceeded",
"message": "Too many requests. Please retry later."
}
}
```
The `429` carries `Retry-After` with the number of seconds to wait, alongside the same `RateLimit` headers.
## Handling limits gracefully
On a `429`, wait, then retry — doubling the delay each attempt and adding a small random jitter so concurrent clients don't retry in lockstep. Prefer `Retry-After` when it's present.
Don't poll a task or order for status changes in a tight loop. Subscribe to [webhooks](/docs/developer/guides/webhooks) and let Crevio push the update to you.
Walk list endpoints with cursor [pagination](/docs/developer/guides/conventions#pagination) (`limit` + `starting_after`) rather than firing many parallel requests.
Avoid re-fetching values that seldom move (product catalogs, account settings) on every request.
The [`@crevio/sdk`](/docs/developer/guides/sdk) already retries `429` (and transient `5xx`) responses with exponential backoff for you — most integrations on the SDK never need to handle this by hand.
## Next steps
The full error model, including the `429` envelope.
Replace polling loops with pushed events.
Cursor pagination and the rest of the API's ground rules.
Automatic retry and backoff out of the box.