API Rate Limits

What the limit is, and what your client should be ready for.

The limit

The limit is 600 requests per minute per API key, across all v1 endpoints, and it is enforced. Virtually every real integration — Zaps, CRM syncs, order feeds — sits far below this. If you have a workload that genuinely needs more (a large bulk import, a migration), contact us first and we'll make room.

Fair use

Fair use means traffic that serves your pass program. The published limit is the ceiling for bursts; sustained traffic that does no work, such as polling an endpoint every few seconds or repetitively re-syncing an unchanged mirror, is outside it even when it stays under the limit. Until per-plan allowances are published, Pass Studio may, at its discretion, cap non-billed API calls that exceed the greater of 100 times your billed actions or 5,000 calls in any rolling 72-hour period. A cap returns 429 with a Retry-After on the excess only; billed calls are never affected. Inbound integration webhooks are always processed.

Response headers

Every response to a request authenticated with an API key carries the current window:

  • X-RateLimit-Limit — the limit, 600.
  • X-RateLimit-Remaining — requests left in the current minute.
  • X-RateLimit-Reset — when the window resets, as a Unix timestamp in seconds.
  • Retry-After — on a 429 only: seconds to wait before retrying.

Windows are fixed one-minute periods aligned to the clock, so Retry-After is never more than 60 seconds.

The 429 contract

Requests over the limit are rejected with HTTP 429 and the error code rate_limited (see API error codes). Build for it now:

  • Retry with exponential backoff and jitter; honor a Retry-After header when present.
  • Spread bulk work over time instead of bursting — batches of a few requests per second complete comfortably within the limit.
  • Retries are safe: issuance, points with externalRef, and Process Order are idempotent and return the original result rather than double-applying.

Webhooks don't count

Deliveries from Pass Studio to your endpoints (webhooks, Zapier triggers) are outbound and don't consume your request budget. Only calls you make to /api/v1/* count.