# Rate limits

> How many requests you can make, and how to stay within the limit.

Source: https://docs.delivr.no/conventions/rate-limits/

Each merchant can make **600 requests per minute**, across all its keys. Every answer tells you where you stand:

| Header                | Meaning                              |
| --------------------- | ------------------------------------ |
| `RateLimit-Limit`     | Requests per minute (600).           |
| `RateLimit-Remaining` | Requests left in the current window. |
| `RateLimit-Reset`     | Seconds until the window resets.     |

Over the limit you get `429 rate_limited` with `Retry-After` in seconds. Wait that long, then retry with the same `Idempotency-Key`. Rate-limit headers are only sent once your key is accepted.

Failed sign-ins (missing, unknown or revoked keys) are limited per client address: after 30 in 10 minutes, that address gets `429` with `Retry-After` until the window passes, even with a good key.

## Staying within the limit

- Cache `GET /availability` for 60 seconds per store and postal code. It is meant for that.
- Quote when the shopper has an address, not on every keystroke.
- Use webhooks instead of polling orders. Reconcile with the `GET /orders` change feed using `updatedSince`, not by reading every order.
- Spread batch jobs out instead of sending them in a burst.

Need more? Talk to Delivr.