> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fawcos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate limits

> Per-minute and daily limits on each API key.

Every key has two limits. They apply per key, not per organisation, so one busy system does
not use up another system's allowance.

| Limit | Default | Window |
| - | - | - |
| Per minute | 60 requests | One-minute window |
| Per day | 1,000 requests | UTC day, resets at 00:00 UTC |

Limits can be set per key as part of your agreement with FaWCOS. `GET /v1/relying-party/me`
shows the limits and today's usage for the key you call it with.

## When you hit a limit

You get `429 rate_limited`. The two limits behave a little differently:

* **Per minute.** The message says to slow down. The response also carries the standard
  `RateLimit` headers. Wait for the window to reset and retry.
* **Per day.** The response says which limit you reached and when it resets:

```json theme={null}
{
  "error": {
    "code": "rate_limited",
    "message": "Daily request limit reached",
    "details": { "limit": 1000, "resets_at": "2026-10-17T00:00:00.000Z" }
  }
}
```

A request refused by the per-minute limit does not count towards the day.

## Good practice

* Retry a `429` with exponential backoff and jitter, and stop retrying once `resets_at` is far away.
* Do not poll. Ask for consent once, then check its status at a sensible interval.
* Spread batch work across the day instead of sending it in a burst.

## Failed authentication

Requests with a missing or invalid key cannot be counted against a key, so every request, valid
or not, also counts against a ceiling per network address. Repeated bad requests from one address
are refused with `429`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.