Rate Limiting

Every authenticated API request sits behind at least one named limiter. Buckets apply per token, not per IP, because that's the unit of identity agents and Zaps share. Hit a limit and you'll get a 429 response wrapped in the standard error envelope with code: "RATE_LIMITED" plus a Retry-After header.

Named bucketsCopy Anchor Link

When the caller is unauthenticated (no token), the api-token limiter falls back to a per-IP key so accidental traffic bursts still get caught. The mcp limiter applies the same fallback but at a much tighter ceiling — unauthenticated traffic on the MCP surface is always either an exploration probe or a misconfigured client, never legitimate tool use, so the bucket is sized to fail fast rather than accommodate sustained calls.

Response headersCopy Anchor Link

Every rate-limited response carries Laravel's standard rate-limit headers:

X-RateLimit-Limit: 300
X-RateLimit-Remaining: 278
Retry-After: 47

Honour Retry-After before retrying — it reports the number of seconds until the bucket refills.

Error shapeCopy Anchor Link

{
  "error": {
    "code": "RATE_LIMITED",
    "message": "The rate limit for this token has been exceeded.",
    "remediation": "Back off and retry after the time hinted by the Retry-After header.",
    "docs_url": "https://docs.subscriby.net/api/v1/errors#rate-limited",
    "request_id": "00-abc..."
  }
}

Designing Zaps and agentsCopy Anchor Link

• Polling triggers: keep the interval ≥ 15 seconds per Zap. Zapier enforces this internally anyway.
• Bulk imports: chunk writes into batches of 100–200 and respect Retry-After when a 429 fires. Concurrency doesn't beat the limiter — it counts concurrent calls the same as sequential ones.
• MCP agents: assume the 120/min bucket is shared across every tool call in a session. Claude Desktop, Cursor, and VS Code throttle their own tool calls; hitting the limit in practice usually means a tight loop on your side.
• Bulk access-code generation: the 10/min bucket mirrors the rate applied in the dashboard. If you need more codes, raise each call's quantity instead of issuing more calls.

Upstream capsCopy Anchor Link

The hourly api-token cap (10,000 requests) deliberately allows a sustained ~160 requests/min before the per-minute ceiling kicks in. If your integration needs a higher sustained rate, contact support — we don't publicly bump the default but can raise it per-token on request.