Skip to main content
Every key has two limits. They apply per key, not per organisation, so one busy system does not use up another system’s allowance. Limits can be set per key as part of your agreement with FaWCOS. GET /v1/relying-party/me shows the limits and today’s usage for the key you call it with.

​
When you hit a limit

You get 429 rate_limited. The two limits behave a little differently:
  • Per minute. The message says to slow down. The response also carries the standard RateLimit headers. Wait for the window to reset and retry.
  • Per day. The response says which limit you reached and when it resets:
A request refused by the per-minute limit does not count towards the day.

​
Good practice

  • Retry a 429 with exponential backoff and jitter, and stop retrying once resets_at is far away.
  • Do not poll. Ask for consent once, then check its status at a sensible interval.
  • Spread batch work across the day instead of sending it in a burst.

​
Failed authentication

Requests with a missing or invalid key cannot be counted against a key, so every request, valid or not, also counts against a ceiling per network address. Repeated bad requests from one address are refused with 429.