Rate limits

Generous by default, since scan stations fire fast, with a few sensitive routes held much tighter.

Global limit#

Every route defaults to 600 requests per minute. A busy factory floor with several stations scanning at once sits comfortably under this.

Login and pairing routes#

Sign up, staff and retailer login, password reset requests, and swapping a pairing code for a station token are limited far more tightly, to slow down anyone guessing at credentials or codes.

The 429 response#

Every response carries your current standing, whether or not you are close to the limit: x-ratelimit-limit, x-ratelimit-remaining and x-ratelimit-reset (seconds until the window resets).

Once the limit is reached, a request gets 429 instead of running, with a retry-after header giving the number of seconds to wait.